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The purposes of the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and 


Protection of Privacy Act are: 
a) To provide a right of access to information under the control of government organizations in accordance with 
the following principles: 
e information should be available to the public; 
e exemptions to the right of access should be limited and specific; 


e decisions on the disclosure of government information may be reviewed by the Information and 


Privacy Commissioner. 


b) To protect personal information held by government organizations and to provide individuals with a right of 


access to their own personal information. 
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Commissioner/Ontario 
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The introduction of a number of programs and legislation 
by our federal government, such as the Anti-terrorism Act, the 
measures contained in Bill C-17, Public Safety Act, changes to 
the Customs Act to implement a new Advance Passenger 
Information/Passenger Name Record program, and the 
debate over implementing the Cybercrime Treaty and 
related “Lawful Access” provisions, are clear assaults upon 


the privacy rights of Canadians. 


Governments throughout the world also demonstrated 


an increased resistance to providing open access to files. 


Again, this clampdown was made under the guise of 


security protection. 


One of the key challenges for all governments in these tur- 
bulent times is the delicate balance of showing leadership on 
real issues of national importance while avoiding invoking 
major policies or initiatives without due consideration of the 


long term impact of these changes. 


Business, on the other hand, made great strides in 2002 


towards establishing the policies and systems needed to 


protect the privacy of its customers and suppliers. Much of 


this was done to ready itself for the implementation of 


private sector privacy laws — but also simply because good 


privacy = good business. 


On January 1, 2004, a federal law, the Personal Information 
Protection and Electronic Documents Act, will come into force 
— covering all private sector commercial enterprises in 
provinces that have not brought in comparable legislation. 
Unfortunately, Ontario, which had worked so hard on 
developing its own private sector and health sector privacy 


legislation, has yet to introduce a Bill. Enacung such a law 


was the #1 recommendation 
I gave to the government last 
year and remains the top pri- 


vacy issue in the province. 


The federal law, while laud- 
able, falls far short of what 
was included in the draft 
Ontario privacy legislation. 
Of particular concern to me 


is that without provincial 


legislation, Ontario citizens 


Ann Cavoukian, Ph.D 


Information and Privacy Commissioner 


will be left without any com- 
prehensive health privacy 
protection. The government has said that it remains com- 


mitted to introducing such a law. Time will tell. 


The good news is that we have the framework to move pri- 
vate/health sector privacy legislation forward. The Privacy of 
Personal Information Act, developed by the Ministry of 
Consumer and Business Services (MCBS), is ready to go. 
MCBS did an excellent job in consulting extensively with 
stakeholders and resolving many of the key issues raised by 
businesses, health care practitioners and other organizations 
— there is now clear public support for the legislation. We 
need a made-in-Ontario law that takes into account the par 


ticular needs of provincial organizations. 


I was disappointed that the Ontario government did not 
implement my recommendation to appoint a senior public 
servant as chief privacy officer (CPO). The position of CPO, 


which has become commonplace in the business community, 
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would help ensure that government programs and services 
are designed and delivered in a manner that both protects 


and enhances the privacy of Ontarians. 


Last year, we also called upon the government to initiate a 
public consultation process to identify how Ontario's access 
and privacy legislation can be amended to properly deal with 
the treatment of personal information in electronic format in 
public registries. The government undertook a focused 
review of the public registries under its direct control, but 
there is still a need for leadership to address the privacy 
issues raised by the growing number of electronically avail- 
able registries in the provincial, municipal, broader public 
and self-regulated sectors. This complex issue will not simply 
go away. I am certain that solutions can be found, but the gov- 


ernment needs to give the issue careful and focused attention. 


In my 2001 report, I recommended that any organization 
covered by the Acts that is considering installing a video sur- 
veillance camera in a public place should first meet with my 
office to discuss the privacy issues. I’m pleased to report that 
we have worked with a number of municipalities over the 
past year to ensure that their video surveillance programs 
operate in a manner that meets their public safety and law 
enforcement needs while still complying with our Guidelines 


for Using Video Surveillance Cameras in Public Places. 


Over the past year, we have seen a recognition by various 
branches of the Ontario government that privacy-enhancing 
technologies (PETs) should play a role in the design process 
for new projects or systems. However, to date, the govern- 
ment has not translated this acceptance into action. I believe 
this is a critical and logical step to ensure that the rights and 
privacy of citizens are protected in an increasingly electronic 


world. (See Key Issues) 


I also believe that technology has real and practical applica- 
tions in furthering the goal of open government. In- 
formation management systems that cannot retrieve and 
disseminate information in a timely fashion are a barrier to 
accessibility and accountability. The government has recog- 
nized that privacy design principles play an important role 
in ensuring that information technology systems are built in 
a manner that is privacy protective. There is no reason why 
the same theory should not apply to access. I am calling on 


the government to show leadership by developing access 
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design principles to ensure that the introduction of new 
technologies facilitates routine disclosure and active dissem- 


ination of government-held information. 


Overall, the province also needs to do a better job with its 
records management systems. An effective electronic 
records and document management system would dramati- 
cally improve the ability to locate government records while 
better ensuring that individual privacy is protected. The 
tools are available to protect privacy and facilitate the 
sorting, collection and access to data. Given that the gov- 
ernment is committed to moving more and more services 
on-line, it is critical that these technologies be part of the 
system design — not an afterthought or expensive retrofit 


once the damage has already been done. (See Key Issues) 


I also believe the time has come for the Ontario government 
to introduce comprehensive open meetings legislation. 
Throughout the United States, open records laws (like our 
Acts) and open meetings laws are seen as complementary 
components of the broad system of public accountability. The 
same theory should apply in Ontario. We need a comprehen- 
sive legislative framework that will ensure proper notice, a 
right to complain, an efficient and accessible oversight body 
to investigate complaints and resolve disputes, and remedies 


and penalties if the law has been breached. (See Key Issues) 


I’m pleased to report that the provincial government has 
accepted our recommendation to implement a Human 
Resources Plan for the freedom of information and privacy 
protection community. Much progress was made during 
2002 in addressing recruitment, retention and training needs 
for Co-ordinators and other FOI program staff. The goal of 
this exercise is to ensure that staff working in this important 
field are recognized for their skills and expertise, and that 
the Ontario Public Service as a whole has the human 
resource capacity to deal with retirements and vacancies as 
they arise, without compromising continuous quality service 


delivery in compliance with the legislation 


During the past year, we also worked with a broad array of 
government organizations — from ministries to school boards 
to police services — on a number of special joint projects, 
including developing best practices, guidelines and training. 
In particular, I am pleased with the work we have done with 
policing agencies across the province to strengthen awareness 


and commitment to privacy and access principles. 


In spite of these challenging times, for the fourth year in a 
row, provincial institutions have improved their response 
rates in addressing FOI requests. In 2002, 57.8 per cent of the 
requests to provincial organizations were answered within 
30 days, up from 55.6 per cent in 2001 and only 42 per cent 
in 1998. And if two of the larger ministries, which have their 
own particular issues, are excluded from the calculation, the 


2002 figure increases to an impressive 82.4 per cent. 


Again this year, the 30-day compliance rate for municipal 
requests is higher than the provincial sector, but the 75.9 per 
cent overall figure continues the downward trend since 1999, 
when the response rate was 85 per cent. Much of this decline 
can be attributed to one particular police service, which saw 
its numbers drop nearly 20 per cent last year. If this institu- 
tion is excluded, the compliance rate increases to 84.2 per 


cent, which is highly impressive. 


PERSONAL THANKS 
I would like to sincerely thank the staff of my office. With 


the increasing demands and expectations placed on this 
office, | am so fortunate to have such talented and dedicated 
colleagues. Each one takes our mandate extremely seriously 
and works diligently on behalf of everyone in this province. 
I am grateful for their professionalism and I am proud to 
have the opportunity to work with them in support of open 
government and the protection of privacy. My heartfelt 


thanks to you all! 


3 IPC Annual Report 2002 


Ontario’s Freedom of Information and Protection of Privacy 
Act, which came into effect on January 1, 1988, established 
an Information and Privacy Commissioner as an officer of 
the Legislature to provide an independent review of the 
decisions and practices of government organizations 
concerning access and privacy. The Commissioner is 
appointed by and reports to the Legislative Assembly of 
Ontario. The Commissioner is independent of the govern- 


ment of the day in order to ensure impartiality. 


The Municipal Freedom of Information and Protection of 
Privacy Act, which came into effect January 1, 1991, broad- 
ened the number of public institutions covered by Ontario’s 


access and privacy legislation. 


The Information and Privacy Commissioner (IPC) plays a 
crucial role under the two Acts. Together, the Acts establish 
a system for public access to government information, with 
limited exemptions, and for protecting personal informa- 
tion held by government organizations at the provincial or 


municipal level. 


The provincial Act applies to all provincial ministries and 
most provincial agencies, boards and commissions; colleges 
of applied arts and technology; and district health councils. 
The municipal Act covers local government organizations, 
such as municipalities; police, library, health and school 


boards; public utilities; and transit commissions. 


Freedom of information refers to public access to general 
records relating to the activities of government, ranging from 
administration and operations to legislation and policy. The 
underlying objective is open government and holding elected 


and appointed officials accountable to the people they serve. 
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Privacy protection, on the other hand, refers to the safe- 
guarding of personal information — that is, data about 
individuals held by government organizations. The Acts 
establish rules about how government organizations may 
collect and disclose personal data. In addition, individuals 
have a right to see their own personal information and are 


entitled to have it corrected if necessary. 


The mandate of the IPC is to provide an independent review 
of government decisions and practices concerning access and 
privacy. To safeguard the rights established under the Acts, 
the IPC has five key roles: 


e resolving appeals when government organizations 


refuse to grant access to information; 


® investigatin rivacy complaints about government 
g £ Pp y p g 


held information; 


e ensuring that government organizations comply with 
the Acts; 


e conducting research on access and privacy issues and 
providing advice on proposed government legislation 


and programs; and 


¢ educating the public about Ontario’s access and pri- 


vacy laws, and access and privacy issues. 


In accordance with the legislation, the Commissioner has 
delegated some of the decision-making powers to various 
staff. Thus, the Assistant Commissioner and selected staff 
were given the authority to assist her by issuing orders, 
resolving appeals and investigating privacy complaints. 
Under the authority of the Commissioner, government prac- 
tices were reviewed, one indirect collection of personal infor- 
mation was approved and two proposed inter-ministry 


computer matches were commented on. 


OPEN MEETINGS 


J 


agemadanda greater levels of transparency in the decis 


Every once in a while, these demands crystallize around a 
particular element of public accountability and governments 
take concrete action. In Ontario, we saw that happen in the 
1980s, when our provincial government decided it was time 
to codify the right of access to government-held records. 
And there really is no ambiguity about why the Freedom of 
Information and Protection of Privacy Act was introduced and 
passed into law: it was seen as a necessary and important 
component of our system of public accountability. As then- 


Attorney General Ian Scott said in introducing the new law: 


When there is true openness in government, we will 
have a society that 1s trustful of its government, not 
fearful of it. We will have a society that ts enlightened 
by information and able to make thoughtful choices as 
to the future shape of our society. 


That was a defining moment in the evolution of our society, 
and with 15 years of experience under our belts, we can all 
see how important the law has been in improving trans- 


parency and encouraging integrity in our governments. 


But FOI is not the only component of the accountability 
framework. People also expect that governments will make 
decisions in an open and transparent forum. Our Legislative 
Assembly does not and cannot meet in private. And at the 
municipal level, public bodies are required by law — with 
limited exceptions — to conduct their business at open meet- 
ings where the public can attend and observe the debate on 


the issues of the day. 


NMmaking nrnreccac n anverr ant 
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However, any system of accountability requires both rules 
and a process for enforcing them. The Municipal Act estab- 
lishes a series of rules regarding the conduct of official busi- 
ness by municipal governments. They target the policy 
objective of open and transparent decision-making, but we 
have some concerns that they may not go far enough in 


addressing public expectations. 


In the United States, open meetings laws and FOI laws are 
often seen as complementary components of the broader 
system of public accountability. In Connecticut, for example, 
regulations governing open meetings and open records are 
both included in the same legislation, the Freedom of 
Information Act. Colleen Murphy, managing director of the 
Connecticut Freedom of Information Commission — which 
oversees the law — feels strongly that both components are 
necessary in order to ensure open government: “The two ele- 
ments of our law are both designed to shed light on the oper- 
ations of government, and we're not unique. Throughout 
the United States, citizens take it for granted that they will 
have a right of access to records, and also an ability to ensure 
that government decisions are made in the open at meetings 


that are accessible to the public.” 
And what would an open meetings law look like? 


We don’t have the answer to that, but we have given some 
thought about what elements an open meetings law should 


have in order to be comprehensive and effective. 
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It must: 


* impose obligations on public bodies to ensure that meet- 
ings are open to the public and that people are given 


proper and adequate advance notice; 


© provide members of the public with a right to complain 
if they feel that open meeting rules have not been fol- 


lowed; 


e establish an efficient and accessible oversight body 
that can investigate complaints and resolve disputes; 


and 


* provide remedies and penalties if the law has been 


breached. 


And we don’t have to start from scratch. The Municipal Act, 
to some extent, already deals with notice requirements for 
meetings, and existing U.S. legislation can help identify how 
these provisions can be enhanced and expanded. The Public 
Proceedings and Records Act of the State of Hawaii, for 
example, provides that no meeting can be held without 
written public notice, including an agenda of items to be dis- 
cussed at the meeting, at least six days before the meeting. If 
the notice period is not complied with, the meeting must be 
cancelled, and the agenda of a properly constituted meeting 
cannot be amended to include a new item of major impor- 
tance unless the meeting is postponed in order to re-notify 


the public. 


And what constitutes a “meeting?” This issue is not a new 
one. Municipalities and other public bodies have grappled 
over the years with defining various types of meetings, and 
the courts have even been involved at times in providing 
direction on this issue. But the traditional concept of a 
meeting, where a group of people get together in person at 
the same time in a room to debate an issue may no longer be 
adequate. Changes in technology have transformed tradi- 
tional communications methods, and it’s important that 
issues raised in this context are filtered through the open 
meetings policy framework. Is it possible for a municipality 
to hold an open meeting through teleconference or video- 
conference? What about an exchange of e-mail messages, or 
a debate in an Internet chat room? How does voice mail fit 


into the mix? 


It is also important to ensure that an open meetings law 
covers all appropriate public bodies. Municipal corporations 
covered by the Municipal Act would clearly be covered, 


but there are many other public bodies operating at the 
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municipal level that hold public meetings. We would argue 
that institutions covered by the Municipal Freedom of 
Information and Protection of Privacy Act provide an appro- 
priate precedent for defining the scope of any new open 


meetings law. 


And what about provincial bodies? In the U.S., most open 
meetings laws apply to both state and local governments. It 
may be worth considering whether an open meetings law in 
Ontario should apply not only to municipal governments but 


also to provincial agencies, boards and commissions. 


One of the most significant deficiencies in the current open 
meetings scheme is the lack of efficient and accessible over- 
sight. What does someone do if he feels that there was insuf- 
ficient notice of a meeting, or that the public body dealt with 
important issues that were not included on a posted agenda? 
Who can someone complain to if she believes a matter dealt 
with at an in camera meeting should have been discussed in 
public? A lengthy and costly court process is clearly not the 
answer. Complaints must be dealt with quickly and there 
must be a dispute-resolution process that is flexible and acces- 
sible to everyone. In U.S. jurisdictions that have a Freedom of 
Information Commission, that body is given oversight 
responsibility for both FOI and open meetings laws. That's a 


model that may make sense here in Ontario as well. 


And finally, any open meetings scheme must have teeth. If 
there has been a breach of the rules, as determined by the 
oversight body, there has to be a remedy or series of optional 
remedies available to address the problem. In Connecticut, if 
the Freedom of Information Commission determines that a 
meeting has been held without proper notice, it has the dis- 
cretion to declare any or all actions taken at the meeting to 
be null and void. But, as Colleen Murphy points out: “A null 
and void finding is not the norm. Our approach is to 
encourage proper practices through education, and penal- 
izing public bodies is generally reserved for the relatively 


few egregious situations we encounter.” 


The time has come for Ontario to give focused attention to 
the open meetings component of our public accountability 
system. We need comprehensive legislation that builds on 
our own past practices, while at the same time looking to the 
experience of other jurisdictions that have already made the 
move to a dedicated open meetings law. The public 1s 
demanding that governments be more open and transparent, 
and an enhanced open meetings scheme is an ideal vehicle 


for addressing this expectation. 


PRIVACY-ENHANCING TECHNOLOGIES 


LJ 


KEY ISSUES 


AND THEIR DEPLOYMENT IN GOVERNMENT 


The IPC has challenged various branches of the Ontario government to introduce privacy-enhancing technologies 


(PETs) into pilot projects or new initiatives. While staff and senior executives have provided a sympathetic ear, it is dif- 


ficult to point to any real progress. 


Granted, the province has embarked on undertaking privacy 
impact assessments for new technology initiatives. And many 
of these assessments are first rate and comprehensive — ana- 
lyzing the vulnerabilities and risks in the collection and 


management of personal information. 


A number of projects shared with the IPC have introduced 
design elements into the program architecture that have 
attempted to address certain privacy vulnerabilities. 
However, from the IPC’s perspective, far more can be done 


when it comes to designing privacy into the architecture. 


The term privacy-enhancing technologies gained credence 
following the release in 1995 of Privacy-Enhancing 
Technologies: The Path to Anonymity, a paper jointly 
authored by the IPC and the Dutch Data Protection 
Commission. Since then, the focus of PETs development has 
been primarily on Internet and personal tools. However, that 
is changing. A recent analysis by the OECD — the 
Organisation for Economic Development and Co-operation 
— contained a description of PET functionalities and ana- 
lyzed more than 80 PETs. 


Among these were technologies that focused on more than 
just ways to surf the Web anonymously, encrypt e-mail 
or provide protections against privacy invasions, from 
cookies to Web bugs. The International Workshop on 
Privacy Enhancing Technologies, the undisputed focus 
of the world’s leading researchers and academics in 
the field of PETs, accepted two papers for its April 
2002 conference that focused on Enterprise Privacy 
Practices and Privacy Enhancing Service Architectures 


(http://petworkshop.org). 


It is no longer accurate to say that enterprise-wide privacy 
products and solutions do not exist. First, many of the proj- 
ects and systems-development work undertaken by the gov- 
ernment do not use off-the-shelf products in a plug and play 


mode. Instead, a combination of core products, often cus- 


tomized, with many lines of custom code, are brought 
together in a solution. In other situations, projects start with 
a business case and business requirements cycle that lead to 


countless programmers developing code. 


This provides an excellent opportunity to design privacy 
directly into the system, starting at the request for proposal 
(RFP) stage. Many of the RFPs issued by government organ- 
izations would benefit from clearer privacy requirements. 
This step alone will push vendors to ramp up their capabili- 
ties to design privacy protections right into a system. The 
requirement for a privacy architect, however, as basic as 
requiring a security architect, is still missing in most, if not 


all, RFPs. We await much-needed changes in this area. 
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KEY ISSUES 


AVOIDING AND CONTAINING PRIVACY BREACHES 


All government institutions — from municipalities to school boards to police services to ministries — deal with a large 


volume of information on a daily basis. Some of this is personal information. A privacy breach occurs if personal infor- 


mation is collected, used, disclosed or disposed of in a manner that is contrary to the privacy provisions of the Acts. 


Despite what can be sincere efforts by institutions to safe- 
guard personal information, privacy breaches do occur. The 
IPC is committed to working with institutions to promote 
practices that advance the protection of personal information 
by reducing the opportunities for breaches — and containing 


any that do occur. 


What are some examples of privacy breaches? The per- 
sonal information of one individual included with other 
material in an envelope sent to someone else; files with 
personal information are left behind when a move 1s made; 
the personal information of students that ends up blowing 
in a street when it is put out in a garbage bag, rather than 
being shredded. Any of these situations would be instances 
of privacy breaches, and could be the subject of a privacy 


investigation by the IPC. 


Often, breaches occur when an institution has failed to 
ensure that proper measures are in place to protect per- 
sonal information. The situation can quickly grow worse if 
the institution does not have an action plan in place to deal 


with a privacy breach. 


AVOIDING PRIVACY BREACHES 


There are several ways that institutions can be proactive, 
including by developing written policies and procedures 
that incorporate privacy protection into the institution’s 
every-day work. For instance, institutions that regularly 
send or receive personal information should have written 
policies and procedures setting out proper protocols for 


dealing with mail, e-mail and faxes. 


Some key elements of policies that are privacy protective 
include: limiting the disclosure of personal information to 
those that need to know; limiting the use of the personal 
information to the purposes for which the information was 
obtained or compiled, or for a consistent purpose; and 
taking reasonable steps to protect the security and confi- 
dentiality of personal information that is to be destroyed, 
including protection during its storage, transportation, 


handling and secure destruction. 
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Written policies or procedures are important both 1n codi- 
fying proper privacy protection practices and in serving as 
an educational tool for staff. Whenever possible, it is useful 
to augment written policies with staff training sessions 
that promote understanding of the policies and allow for 
questions and discussion about the Acts. As well, there 
should be a privacy component included in all orientation 


programs for new staff. 


Another proactive step that institutions can take is to 
ensure that privacy is a consideration whenever there are 
substantive changes made to institutional structures. 
Wherever new technologies, information systems, pro- 
grams, or policies are introduced, the institution should 
conduct a privacy impact assessment (PIA). Management 
Board Secretariat’s PIA is available on its Web site 
(http://www.gov.on.ca/MBS/english/FIP/PIA/). 


DEALING WITH A PRIVACY BREACH 


It is also crucial that institutions have procedures in place 
that address what staff should do in case a privacy breach 
does occur. In these situations, institutions should take sev- 
eral immediate steps in rapid succession in order to mini- 


mize the adverse effects of any breach. 


The first step is for the institution to identify the scope of 
the breach, and then make its best efforts to contain it. For 
instance, if the breach arose as a result of a letter con- 
taining personal information being sent to the wrong 
person, staff should attempt to contact the recipient and 
retrieve the documents containing the personal informa- 
tion sent in error. If this is not possible, at a minimum, staff 


should confirm that the document has been destroyed. 


In other situations, the appropriate action would vary 
depending on the nature of the breach. For instance, if the 
privacy breach involved an unauthorized user gaining access 
to an electronic database, the institution should take steps to 
ensure that access is no longer possible. Depending on the 
situation, the appropriate action may be to either change 


system passwords, or to temporarily shut down the system. 


In addition, individuals whose personal information has been 
compromised should be notified as soon as possible that a 
breach has taken place. They should be advised of the nature 
of the personal information and the scope of the breach, as 


well as the action being taken to rectify the situation. 


Upon learning of the breach, the institution should also 
notify the other people who need to be advised. This 
would include the IPC, the institution’s head or delegate, 


and its Freedom of Information and Privacy Co-ordinator. 


The institution should then conduct an internal review 
into the matter, often in conjunction with an IPC investi- 


gation. The objectives of the internal review are to: 


e ensure that the immediate requirements concerning 


containment and notification have been addressed; 


e review the circumstances surrounding the breach; 


and 


¢ review the adequacy of existing policies and procedures 
in protecting personal information. After the review is 
complete, the institution should advise the IPC of its 
findings and work with the IPC to make any necessary 


changes. 


GUIDELINES:STEPS TO TAKE 
Recently, the IPC published a paper that offers practical 


guidelines on how to contain a privacy breach. The paper, 
Guidelines: Steps to Take if a Privacy Breach Occurs, is avail- 
able on the IPC Web site (www.ipc.on.ca). 


The IPC has issued a number of other publications that pro- 
mote practices that are protective of personal privacy. These 
are also available on the IPC’s Web site, or in hardcopy, on 


request. Among these are: 
© Guidelines on Fax Transmission Security; 


© Guidelines for Using Video Surveillance Cameras in 


Public Places; 


© Guidelines for Protecting the Privacy and Confidentiality 
of Personal Information When Working Outside the Office; 


¢ Moving Information: Privacy & Security Guidelines; 
¢ Tips on Protecting Privacy; and 


e Safe and Secure Disposal Procedures for Municipal 


Institutions. 
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KEY ISSUES 


ELECTRONIC RECORDS AND DOCUMENT MANAGEMENT SYSTEMS: 
A NEW TOOL FOR ENHANCING ACCESS AND PRIVACY 


Good records management is an essential pillar that supports the public’s access and privacy rights under the Freedom 


of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act 


(the Acts). An individual cannot access a record unless it can be found. Moreover, if records are well organized and 


easy to retrieve, government organizations can more easily comply with the 30-day timeline in the Acts for responding 


to access requests. 


A privacy-protective records management scheme promotes 
compliance with the collection, retention, use, disclosure and 
disposal requirements of the Acts and their accompanying 
regulations for records that contain personal information. It 
ensures that only those staff members that need a record for 
the performance of their duties shall have access to it, and 
that reasonable security measures are put in to protect per- 


sonal information from misuse or inappropriate disclosure. 


Unfortunately, records management in both provincial and 
municipal institutions in Ontario has suffered during the 
past decade. There has been a downsizing of records man- 
agement staff, which means that record-keeping responsibil- 
ities now fall more heavily on individual public servants. In 
addition, records management systems have not kept pace 
with the shift from paper to electronic records. Although 
government organizations continue to print and maintain 
paper documents as “official records,” the vast majority of 


records are now created and stored electronically. 


During the past few years, governments in some jurisdictions 
have attempted to modernize their record-keeping practices 
by implementing electronic records and document manage- 
ment systems (ERDMSs). In Ontario, Management Board 
Secretariat's Office of the Corporate Chief Technology 
Officer (OCCTO) and the Archives of Ontario have devel- 
oped a proposed “enterprise records/document management 
solution.” This solution, which sets out a framework for 
records and document management in the provincial gov- 


ernment, would be made up of two components: 


¢ Individual records and document management systems 


implemented at ministry and program levels; and 


e A single government-wide search engine that would 
allow public servants to access “metadata” about 


records and documents across government. 


10 IPC Annual Report 2002 


WHAT IS AN ERDMS? 


An ERDMS is a tool that enables an organization to effi- 
ciently manage all records and documents that are created 
and maintained in both electronic and hardcopy format. It 
may be server or Web-based and capable of managing 
numerous records, including word processing documents, 


databases, spreadsheets, e-mail messages and Web pages. 


The potential role that ERDMSs can play in enhancing 
access and privacy rights is striking a chord in a growing 
number of jurisdictions. For example, in its 2002 Report to 
the New York Governor and State Legislature, the 
Committee on Open Government recommended that the 
state government design electronic information systems in 
a manner that maximizes access while concurrently pro- 


tecting privacy. 


The Archives of Ontario has also published a draft paper, 
Records/Document Management Systems (R/DMS) Standard — 
Technical Specifications, that defines the requirements for 
ministry and program-level records and document manage- 
ment systems. The Archives and OCCTO have integrated 
access and privacy principles from the provincial Act into 
both the proposed enterprise records/document management 


solution and the standard that supports the solution. 


Few provincial or municipal institutions have imple- 
mented full-fledged ERDMSs that encompass both 
records and document management requirements. 
However, some institutions are putting in place interim 
solutions that demonstrate the potential access and privacy 
benefits of such systems. For example, the Ministry of 
Natural Resources (MNR) and the Ministry of Public 
Safety and Security (MPSS) are testing and implementing 
systems that contain features that can enhance public 
access to government-held information while simultane- 


ously protecting the privacy of personal information. 


MINISTRY OF NATURAL RESOURCES 
The MNR is currently designing and implementing an 


innovative Web-based document management system that 
will enhance its ability to more efficiently locate records 
and facilitate the routine disclosure and active dissemina- 
tion of information to the public. The system is made up of 
two components: An online document management system 
(ODMS) and an online Web publishing system (OWPS). 
Although the system is not a fully functional ERDMS 
(lacking basic capabilities for managing the retention and 
disposal of records), it has many important features. In 
addition, its developers are exploring new enhancements 


to bring it closer to full functionality. 


The ODMS involves putting corporate documents, such as 
briefing notes, letters and presentations, in a central repos- 
itory that can be accessed by all ministry staff. When staff 
create corporate documents, they are required to save 
them into the ODMS database, which serves as the central 
repository. The system also has a search function that 
allows staff to search the central repository for documents 
by keying in detailed search terms such as the title, author 


and creation date of a requested document. 


The second component of MNR’s document management 
system, the OWPS, telescopes into the central repository and 
looks at the document’s “visibility” status. If the document 
has been marked as “visible” for the Intranet, Internet or 
Extranet, it will be pulled out of the central repository and 
made available for posting on these sites. MNR will be care- 
fully reviewing all documents to ensure that no personal 
information or other information subject to the mandatory 
exemptions in the provincial Act is inadvertently disclosed on 


MNR’s public Web site. 


From an access perspective, MNR’s document management 
system has two significant pluses. First, the ministry’s 
freedom of information office can use the ODMS as a 
starting point for locating and retrieving documents in 
response to access requests. Second, the automated nature of 
the Web-publishing tool will help MNR to significantly 
expand the routine disclosure and active dissemination of 


information to the public. 


MINISTRY OF PUBLIC SAFETY AND SECURITY 


The MPSS is testing a new document management system 
in its business planning and issues management branches. 
Whenever a user creates and saves a document, the docu- 
ment management system requires that the document be 
classified. The user must attach a name and file classification 
to the document and specify access and security levels (i.e., 
who can access the document). The document is then 


deposited in a central repository. 


That central repository has significant potential for enabling 
the ministry to more efficiently locate records when dealing 
with access requests. A document can be retrieved by its file 
name, creator’s name, or date of creation, for example, or 
through a keyword-based full-text search function. In addi- 
tion, for records that contain personal information, the set- 
ting of access and security levels, which makes a document 
available only to certain staff, enhances privacy by ensuring 
that only those staff that need a document for the perform- 


ance of their duties shall have access to it. 


The system also allows a user to view the history of a docu- 
ment. In other words, a user can see who has accessed the doc- 
ument, when it was accessed, and what changes or edits were 
made. This is important from an access perspective, because it 
provides requesters with a level of assurance that they are 
receiving the final, authentic version of a document. More- 
over, it creates an audit trail, which is particularly useful in 
deterring the misuse or inappropriate disclosure of personal 


information. 


MOVING FORWARD 


In the recommendations section of this annual report, the 
IPC urges both provincial and municipal institutions to 
move forward with replacing outdated records management 
systems with ERDMSs. There is no “one size fits all” model 
that must be adopted by all government organizations. 
Variations in implementation are possible, as long as they 
meet provincial or municipal records management stan- 
dards and are designed in a manner that respects, protects 


and fulfills the public’s access and privacy rights. 
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PRIVACY MISCONCEPTIONS THAT NEED TO BE EXPOSED 


Many organizations have come a long way in addressing privacy issues over the past few years. Gone are the days of 


releasing personal information with unthinking abandon (for the most part). However, there are a number of common 


misconceptions about privacy that can, if accepted at face value, seriously derail good intentions. 


Here is a brief look at some of the key misconceptions: 
Misconception |: Privacy and Security are one and the same 
This misconception seems to be a widely accepted truth, 
especially among technologists and information security 
professionals. The truth is that privacy centres on an 
individual’s control over his or her personal information, 
while information security focuses on an organization’s 
control of the information it collects and manages. The 
two concepts overlap, but there are distinct and potentially 
conflicting areas. For example, information may be 
secure, but at the same time used inappropriately in a 
way that threatens privacy. Tools such as the IPC’s 
Privacy Diagnostic Tool can help organizations learn what 
the key privacy principles are and how they can be 
addressed (www.ipc.on.ca/PDT)). 


Misconception 2: Privacy is essentially a policy issue; security 
is a technology issue 

Privacy experts fall prey to this misconception, perhaps 
more frequently than security experts. All too often, an 
organization believes that by developing a privacy policy 
and undertaking the necessary related communications, 
personal information will be protected. That’s somewhat 
akin to jumping halfway across a deep hole. The deployed 
technology must also reflect the organization’s privacy 
policy. This involves building privacy protections directly 
into the architecture design as well as introducing privacy- 


enhancing technology solutions. 


Misconception 3: Privacy 1s someone else’s problem 

Increasingly, personal information is gathered and used in 
networked settings. A network of organizations can be 
involved in the simplest transactions, such as buying an 
Ontario Government publication online. Personal infor- 
mation is collected and disclosed across programs and with 
contracted third parties. All too often, no comprehensive 
accountability structure for privacy protection exists. Clear 
accountabilities need to be instituted and a culture of pri- 
vacy needs to be developed. These two steps go a long way 


to making privacy everybody’s business in an organization. 
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CONCLUSION 


Privacy protection needs to be built on solid ground, not 


on misconceptions. 


A detailed examination of privacy misconceptions can 
be found in a new, joint paper developed by the IPC 
and Deloitte and Touche, entitled: Privacy and Security: 


Addressing the Issues and Misconceptions. 


FOI AND THE MEDIA: INFORMING THE PUBLIC AND PROMOTING DEBATE 


Transparency. Government accountability. That’s what freedom of information legislation is all about. These laws 


give the public a right of access to records documenting the activities of government, ranging from administration 


and operations to legislation and policy. 


Why? To open the government up to scrutiny, and to hold 
elected and appointed officials accountable to the people 


they serve. 


FOI legislation is extremely important. Some would argue 
that it is one of the cornerstones of a modern democracy. 
Professor Carlton Williams is one such person. He chaired 
the highly-respected Williams Commission in the early 1980s 
whose report served as the blueprint for Ontario’s legislation. 
As he stated in his report, “...there is no question that an 
informed citizenry, one that has access to government-held 
information, is better able to make effective use of the means 


of expression of public opinion on political questions.” 


Years later, after FOI laws had been adopted by the federal 
government and several provinces, Canada’s highest court 
endorsed the Williams Commission’s view. In the well- 
known Dagg decision, now-retired Supreme Court of 
Canada Justice LaForest identified freedom of information 
legislation as a key facilitator of democracy by “help|ing] to 
ensure first, that citizens have the information required to 


participate meaningfully in the democratic process.. a 


And how do citizens exercise these important democratic 
rights? Many of them do so personally and directly. Most 
years, individuals top the list of requesters under both the 
provincial and the municipal Acts. But many others rely on 
the media to represent their interests — by pursing access to 
records that explain how and why public policy is devel- 
oped, and explaining and analyzing information so that 
ordinary citizens can understand how government works. 
By informing the public about the operations of govern- 
ment, not only do members of the media help to hold it 
accountable, but they also provide a forum for the 
exchange of comment and criticism, enabling public par- 


ticipation in debate about matters of public interest. 


Media representatives do not hesitate to voice frustrations 
about using FOI laws — delay in getting governments to 
respond to their access requests being the most common 


complaint. However, reporters are also among the most 


ardent supporters of FOI legislation and its underlying prin- 
ciples. In a study of the U.S. Freedom of Information Act, 
reported in the December 19, 2001 edition of Access Reports, 
the study’s authors — Mark Tapscott and Nicole Taylor — 
note that, while the public might be surprised that members 
of the media do not make the most number of formal access 
requests, federal and state FOI laws are “trumpeted regu- 
larly by journalists as a significant tool in their quest to serve 


> 


the ‘public’s right to know.” 


As Paul McMasters of the Freedom Forum explains, how- 
ever, “the crucial point is not how often journalists use 
[FOI laws], but what they do with the requests they do 
make. Important news stories affecting public policy are 
published literally every day somewhere that would not 


” 


have been possible [without the laws] 


Members of the media here in Ontario, and across Canada, 
are active users of FOI legislation, at the municipal, 
provincial and federal levels, whether filing stories based 
on the results of their own access requests or using infor- 
mation passed on to them from various public interest 
groups or researchers who have obtained records under 
FOI legislation. Hardly a day goes by that we don’t read at 
least one significant article or hear at least one radio or 
television report that is “based on records” obtained under 
freedom of information legislation. From news stories to 


longer term investigative reports, on topics as wide 


; ranging as government cost-overruns, restaurant inspec- 


tion results, environmental contamination, and _ police 
investigation statistics, the media puts issues at the front of 
the public agenda, shedding light on subjects that deserve 


scrutiny and enabling informed debate. 


And every once in a while, a story comes along that has a 
profound impact on public policy. During the past year, 
the federal government was embroiled in a long and 
highly controversial issue concerning how advertising con- 
tracts were awarded. In an article written well into the 


debate, veteran Globe and Mail columnist Hugh Windsor 
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voiced the view that “one savvy access-to-information 
request has become the thread that is unravelling the 
whole image of the squeaky-clean government of Prime 


Minister Jean Chretien.” 


Investigative journalism is arguably the best fit for 
freedom of information laws. It often takes time and a 
great deal of persistence to get to the bottom of a compli- 
cated public policy issue. Organizations such as the 
Atkinson Charitable Foundation augment the resources of 
individual media by providing fellowships for in-depth 
research — the Atkinson Fellowship in Public Policy. The 
fellowship allows one journalist to undertake a year-long 
research project on a topical public policy issue. The founda- 
tion’s literature notes that in considering research proposals, 


“ 


the fellowship “...favours projects dealing with issues that 


are in the forefront of public debate and have implications 


for Canadian society at large.” 


We talked with several of the fellowship recipients about 
how extensively they had used the FOI process. 


The 2002 fellowship winner is Ann Rees of the Vancouver 
Province. She has been a frequent user of federal and 
provincial FOI legislation, both in her daily work and her 
Atkinson research. Not surprisingly, she is a strong sup- 
porter of the law, and in her view: “Freedom of informa- 
tion legislation is key, it allows you to go behind the 
communications wall and get the original documents. It 
allows you to scrutinize government and is a key element 
in holding government accountable.” Rees is using her fel- 
lowship year to research and write a series of in-depth sto- 
ries on the state of freedom of information in Canada, 
focusing on how the legislation impacts the lives of indi- 
viduals. While noting that using the legislation is not 
without its frustrations (e.g., time delay, fees), she is a 
strong supporter of the law. In her view: “The legislation 
is very important to journalism, as is the Atkinson 
Fellowship, which allows you a year to explore a public 


policy issue — there is nothing else like it.” 


Linda Goyette, the 2001 winner, told us that she did not 
use the FOI law in during her fellowship year, but that: 
“In retrospect, I wish I had. When I began my research, I 
thought that all of the information I needed was already in 


the public domain. That was a premature and incorrect 
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conclusion. By the time I published my stories, I realized 
they would have benefited from FOlI-assisted research....” 
Ms. Goyette thinks that “FOI-assisted research has produced 
some excellent results,” but she, like many journalists, is dis- 
turbed by the time it takes for requests to be processed. “FOI 
legislation betrays its purpose if governments process 


requests as slowly and reluctantly as they do.” 


Lisa Priest, currently a reporter for the Globe and Mail, 
was the 1996 Atkinson winner. Her newspaper articles often 
include the familiar reference “obtained in response to a 
freedom of information request.” She notes: “I routinely use 
freedom of information legislation, both provincially and 
federally. Though it can be trying at times and is often very 
labourious, it can also be richly rewarding. My requests often 


turn up original story material.” 


Freedom of information legislation, the media, and indi- 
vidual members of the public: an equation for trans- 


parency, government accountability and informed debate. 


(1) PRIVACY LEG 


Personal health information, and personal information 
held by universities and not-for-profit organizations, is 
far too sensitive to leave outside statutory privacy protec- 
tions. Yet the Ontario government has not moved forward 


with the necessary legislation. 


Unless a made-in-Ontario law is forthcoming, broad sec- 
tors of our society will not be covered by any privacy legis- 
lation. And even though the commercial business sector is 
scheduled to be covered by the federal Personal Information 
Protection and Electronic Documents Act (PIPEDA) on 
January 1, 2004, there are significant gaps in that legisla- 
tion which need to be addressed. I strongly urge the gov- 
ernment to make the introduction and passage of the 


Privacy of Personal Information Act a high priority. 


(2) OPEN MEETINGS 

The time has come for the Ontario government to introduce 
comprehensive open meetings legislation. This topic is dis- 
cussed in detail in the Key Issues section of this report. In 
order to be truly accountable, public organizations at all 
levels must conduct their business in an open manner. 
Although the Municipal Act established open meeting 
requirements, it does not go far enough in addressing public 
expectations of transparency. Throughout the United States, 
“open records” and “open meetings” laws are seen as com- 
plementary components of the broad system of public 


accountability. The same theory should apply in Ontario. 
Any such legislation must: 


¢ impose obligations on public bodies to ensure that 
meetings are open to the public and that people are 


given proper and adequate advance notice; 


¢ provide members of the public with a right to com- 
plain if they feel that open meeting rules have not 
been followed; 


e establish an efficient and accessible oversight body that 
can investigate complaints and resolve disputes; and 


e provide remedies and penalties if the law has been 


breached. 
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Although the concept of building privacy into technology 
has been broadly accepted by government organizations in 
theory, far more can be done when it comes to grounding 
adequate privacy protections into systems architecture 
design. One effective way to do this is to build clear privacy 
requirements into all Requests For Proposals for the pur- 
chase of new technology and/or project design proposals. 
This will push venders to ramp up their capabilities to 


design privacy protections into program architecture. 


There is a pressing need for governments to modernize 
records management. I urge all government organizations, 
at both the provincial and municipal levels, to move forward 
with selecting and implementing electronic records and doc- 
ument management systems (ERDMSs), as described in the 
Key Issues section of this report. These systems should be 
designed in ways that will enhance the public’s access and 
privacy rights, and should be developed in consultation with 
the institution’s Freedom of Information and Privacy Co- 
ordinator. At the provincial government level, institutions 
should consult with the Archives of Ontario and the Office 
of the Corporate Chief Technology Officer, which are taking 
the lead in establishing a vendor-of-record process to facili- 


tate the acquisition of flexible but robust ERDMS systems. 
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J municipal and provincial 


lecte organizations as pa 


e Gain a better understanding of the business of our 
institutional clients in order to deal more effectively 


with appeals and complaints; and 


¢ Provide IPC mediators and institutional staff with an 
opportunity to better understand each other’s roles and 


needs, and develop more productive relationships. 


As in past years, we are pleased with the positive response 
to this initiative. The enthusiasm of government organiza- 
tions, large and small, in working with our mediators on 
both projects of joint interest and in gaining a better 
understanding about our respective roles reinforces our 
view that there are many ways outside the statutory con- 
fines of appeals and complaints where we can work 
together to promote an understanding of and commitment 
to the Acts. 


Here are some highlights of our work in 2002 with the munic- 


ipal sector: 


There is increasing interest amongst schools and school 
boards in creating their own Web sites as a way to support 
communication with their communities. While Web sites 
can be utilized in many positive ways, such as highlighting 
school initiatives and events, schools and school boards 
must exercise caution when deciding whether to post per- 
sonal information on their sites. Together with the Upper 
Grand District School Board and the Peterborough 
Victoria Northumberland & Clarington Catholic District 
School Board, the IPC produced Posting Information on 
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>C’s Tribunal Services Department, as part of its Institutional Relations Program, works collaboratively 


rt of our ongoing efforts to: 


Web Sites: Best Practices for Schools and School Boards. 
Although these best practices focus on issues frequently 
dealt with by schools and school boards, other municipal 
and provincial institutions can refer to these best practices 


for guidance when considering posting information on 
their Web sites. 


DNIIPTE ic TUIIARY 


REEL Vi J i INTURWIA TION FULIUEL MET WU 


Members of the IPC’s municipal mediation team accepted 
invitations from the Freedom of Information Police Network 
to address its spring and fall meetings/training workshops 
for Freedom of Information and Privacy Co-ordinators and 
their staff from local police services across the province and 
from the Ontario Provincial Police. This year, the IPC’s pre- 
sentations focused on reviewing and promoting the paper 
produced jointly in 2001 by the Toronto Police Service and 
the IPC, Exercising Discretion under section 38(b) of the 
Municipal Freedom of Information and Protection of Privacy 
Act — A Best Practice for Police Services. 


Here are some highlights of our work with the provincial sector: 


In 2000-2001, the Freedom of Information and Protection 
of Privacy Office of the Ministry of Health and Long- 
Term Care undertook a business improvement project. 
Together with the IPC, it produced the paper, Freedom of 
Information and Protection of Privacy Office Business 
Improvement Project. The paper provides a brief overview 
of the project and focuses in greater detail on a key ele- 
ment: communications and training for the various client 
groups in the ministry to promote a shared understanding 


and accountability for compliance with the Act. We believe 


this paper is an excellent resource for any institution 
looking to make performance improvements in the area of 


access and privacy. 


MINISTRY OF PUBLIC SAFETY AND SECURITY 


Police services throughout Ontario regularly receive 
requests under the Acts that involve records held by indi- 
vidual police officers, most notably police officer notebooks. 
The IPC and the Policing Services Division of the Ministry 
of Public Safety and Security, in consultation with the 
Ontario Police College, developed a fact sheet on the Acts 
that is now provided to all new police officers as part of their 
basic constable training program. In addition, freedom of 
information has been incorporated into the basic constable 


training course curriculum, as of January 2003. 


Also during 2002, we worked with the Ontario Provincial 
Police to identify ways to improve freedom of information 
and privacy administration throughout the province-wide 
police service. As a result, the OPP has amended its police 
orders to require individual police officers to identify and 
forward their notebooks and other relevant documents to 
the Ministry’s FOI office for processing within eight cal- 
endar days, and to ensure that all records are “true copies” 
with no severed or blacked-out information. The OPP has 
also designed an awareness program for freedom of infor- 
mation and privacy that will be presented to approxi- 
mately 1,000 front line supervisors and middle/senior level 
OPP management staff during 2003. Finally, building on 
the Ontario Police College basic recruit training program, 
the OPP has plans in place to incorporate freedom of 
information and privacy into the dedicated training pro- 


grams offered through the OPP’s Police Academy. 


JOINT EDUCATIONAL SESSION - JUSTICE SECTOR 


This four-year-old program provides provincial access and 
privacy staff from the justice sector and IPC provincial 
mediators with an opportunity to exchange and share 
knowledge. The day-long 2002 educational session was 
attended by IPC mediators and access and privacy staff 
from the Ministry of the Attorney General and the 
Ministry of Public Safety and Security. It included a dis- 
cussion on mediation, a presentation by Susan Woolway 
from the Nova Scotia Freedom of Information and 


Privacy Protection Review Office, who was on a job 


exchange at the IPC as a mediator, and a tour of the new 


North Central Correctional Centre. 


And finally, on two occasions this year, the IPC’s municipal 
and provincial mediation teams combined to do some joint 


work with the municipal and provincial sectors: 


PROMOTING MEDIATION 


Mediation is the preferred method of dispute resolution at 
the IPC, and we are committed to promoting the benefits 
of mediation to our clients. In 2001, the provincial media- 
tion team invited a number of provincial co-ordinators and 
their staff to a meeting to talk about our approach to medi- 
ation and to share with them some of our mediation suc- 
cesses. In 2002, we decided to expand our approach. On 
two occasions, we invited a number of municipal and 
provincial co-ordinators and their staff to meet jointly 
with both mediation teams to discuss the benefits of medi- 
ation in general, and the IPC’s approach to mediation in 


particular. 
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Provincial and municipal government organizations are required under the Acts to submit a report to the IPC on the 


number of requests for information or correction to personal information they received in the prior calendar year, time- 


In 2002, the total number of requests filed with provincial 
and municipal government organizations across Ontario 
jumped by 18 per cent over 2001 levels (26,863, up from 
22,761). This is the fourth straight year that overall request 


volumes have increased. 


Provincial organizations received 9.8 per cent more 
requests in 2002 (12,198, up from 11,110 in 2001). Of these, 
32 per cent (3,973) were for personal information and 67 
per cent (8,225) were for general records. Increases at the 
municipal level were more dramatic. Municipal govern- 
ment organizations received 25 per cent more requests in 
2002 (14,665, as compared to 11,665 in 2001). One-third 
(4,968) were personal information requests and the other 


two-thirds (9,697) were for general records. 


As in past years, the Ministry of Environment received the 
largest number of requests under the provincial Act 
(4,091), followed by the ministries of Health and Long- 
Term Care (2,194), Public Safety and Security (2,062), and 
Labour (939). Together, these four ministries received 76 


per cent of all provincial requests. 


Police Services Boards also repeated this year as the sector 
receiving the most requests under the municipal Act — 51.6 
per cent of all requests. Municipal corporations were next 
with 46.1 per cent, followed by school boards at 1.2 per cent 


and health boards with less than one per cent. 


57.8 per cent of requests under the provincial Act were 
answered within the required 30-day statutory time period. 
This percentage declines to 54.3 per cent when restricted to 


provincial organizations where a minister is the head. 
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onses, outcomes, fees collected, and other pertinent information. 


Requests Received and Completed — 2002 
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Almost four out of five provincial requests (79.3 per cent) 
were answered within 60 days (a 0.7 per cent improvement 
from 2001), but nine per cent took more than 120 days, a two 
per cent increase from 2001. Although the overall 30-day 
response standard has been steadily improving, the per- 
centage of requests that take more than 120 days is also on 
the rise, increasing from four per cent in 2000 to the current 
nine per cent. This trend is alarming and should receive 


attention by provincial organizations in the upcoming year. 


Again in 2002, municipal government organizations outper- 
formed their provincial counterparts, responding to 75.9 per 
cent of requests within 30 days. The 60-day figure comes in 
at 88.6 per cent, and only one in 40 (2.5 per cent) requests 


took more than 120 days to complete, marginally higher 


than the previous year. (For a more detailed discussion of 
compliance rates, see the chapter entitled Response Rate 


Compliance, which follows.) 


The majority of provincial requests in 2002 (68 per cent) 
were made by businesses, while the majority of municipal 


requests (60.6 per cent) came from individuals. 


The Acts contain a number of exemptions that allow, and 
in some situations actually require, government organiza- 
tions to refuse to disclose requested information. In 2002, 
the most frequently cited exemption for personal informa- 
tion requests was the protection of other individuals’ pri- 
vacy (sections 49/38, in the provincial/municipal Acts). 
Privacy protection (sections 21/14) was also the most used 


exemption for general records requests. 


The Acts give individuals the right to request correction of 
their personal information. In 2002, provincial organizations 
received only two requests for corrections and refused three 
(one was a request received in 2001). Municipal organiza- 
tions, on the other hand, received 585 correction requests 
and refused only four. When a correction is refused, the 
requester can attach a statement of disagreement to the 
record, outlining why the information is believed to be 
incorrect. In 2002, two statements of disagreement were filed 
with provincial organizations and two with municipal 


organizations. 


The legislation contains a number of fee provisions. In addi- 
tion to application fees, which are mandatory, government 
organizations can charge certain other prescribed fees for 
responding to requests. Where the anticipated charge is 
more than $25, a fee estimate can be given to a requester 
before search activity begins. Organizations have discretion 
to waive fees where it seems fair and equitable to do so after 


weighing several specific factors listed in the Acts. 


Provincial organizations reported collecting $197,230.14 in 
application fees and $130,785.02 in additional fees in 2002. 
The corresponding numbers for municipal organizations 


were $68,329.00 and $212,576.20. 


Search fees were the most commonly charged category by 
provincial organizations (50 per cent), followed by reproduc- 
tion costs (25 per cent) and shipping charges (16 per cent). 
Municipal organizations, in contrast, most frequently 
charged for reproduction costs (48 per cent), followed by 


search fees (24 per cent) and preparation costs (17 per cent). 


Outcome of Provincial Requests — 2002 (%) 
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Municipal Exemptions Used 


General Records — 2002 


Section 14 — Personal Privacy 2737 (59.9%) 
Section 8 — Law Enforcement 1126 (24.6% ) 


Section 10 — Third Party Information 200 (4.4 %) 


Other — 507 (11.1 %) 


Provincial Exemptions Used 


Personal Information— 2002 


Section 49 — Personal Information 1187 (89.6%) 


Section 65 — Labour Relations 
& Employment 28 (2.1%) 


Section 14 — Law Enforcement 23 (1.7%) 


Other — 87 (6.6%) 


Cases in Which Fees Were Estimated — 2002 


Collected in Full 
Waived in Part 
Waived in Full 


Total Application Fees Collected (dollars) 
Total Additional Fees Collected (dollars) 
Total Fees Waived (dollars) 


Average Cost of 
Provincial Requests 
for 2002 


Personal Information $9.10 


General Records $39.90 
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Municipal Exemptions Used 
Personal Information — 2002 


Other — 324 (6.4 %) 


Section 14 — Personal Privacy 983 (19.3%) 
Section 8 — Law Enforcement 1580 (31.0%) 


Section 38 — Personal Information 2208 (43.3%) 


Provincial Exemptions Used 


General Records — 2002 


Section 21 — Personal Privacy 1598 (52.5%) 
Section 14 — Law Enforcement 495 (16.2%) 


Section 17 — Third Party Information 354 (11.6%) 


Other — 601 (19.7%) 


Provincial Municipal 


51.8% 3077 
0.6% 331 
47.6% 2830 
$68,329.00 
$212,576.20 
$10,831.34 


Average Cost of 


Municipal Requests 
for 2002 


Personal Information $7.73 


General Records $27.61 


To help focus attention on the importance of complying with the response requirements of the Acts, the IPC reports 


compliance rates for each ministry and selected other government organizations. 


PROVINCIAL ORGANIZATIONS 


Four provincial ministries achieved a particularly high level 
of success in 2002 in meeting the 30-day response standard, 
while at the same time dealing with a large volume of 
requests. The IPC recognizes their efforts and acknowledges 
their continued excellence in meeting the statutory standard 
for more than 80 per cent of their requests. They are the 
ministries of the Attorney General, Consumer and Business 


Services, Labour and Transportation. 


The IPC also wishes to recognize the significant improve- 
ment achieved by the Ministry of Public Safety and Security 
(MPSS). In 2001, the former ministries of the Solicitor 
General and Correctional Services (that were merged to 
create MPSS) had a combined response rate of 59.3 per cent. 
In 2002, the rate increased dramatically to 78.7 per cent, 
despite an increase of 15 per cent in the number of requests 
received during the year. Ministry staff are to be commended 


for their efforts. 


Overall, 57.8 per cent of provincial requests were answered 
within 30 days in 2002, an increase from 55.6 per cent the pre- 
vious year. Although there is still much room for improve- 
ment, the IPC is pleased to note the continued upward 
movement in the overall compliance figure since we began 
reporting compliance rates for specific institutions four years 
ago. It is also important to recognize that this modest 
improvement in 2002 was attained despite a significant work 


disruption during a multi-week public sector strike. 


The Ministry of Health and Long-Term Care experienced 
a sharp decline in the 30-day compliance rate during 2002, 
moving to 60.7 per cent from the excellent 83.3 per cent 
figure the year before. The ministry explains that the strike 


played a major role in this decrease, as did a second work 


stoppage at the ministry’s Kingston office during 2002. Our 
hope is that 2002 represents a brief slip in the otherwise 
steady progress made by the Ministry of Health in 


improving compliance rates since 1999. 


Of those ministries receiving at least 100 requests, only the 
Ministry of the Environment failed to achieve a 50 per cent 
compliance rate — meeting the 30-day requirement only 25.6 
per cent of the time. Although this represents almost a dou- 
bling of its 13.6 per cent compliance rate in 2001, this min- 
istry’s performance continues to be a significant drag on the 
overall provincial compliance figure. If the Ministry of the 
Environment is removed from the calculation, the provincial 
rate improves to 77 per cent; and if the Ministry of Health’s 
sub-standard figure is also removed, the rate jumps further 
to 82.4 per cent. It is both significant and encouraging to note 
that the Ministry of the Environment was able to realize siz- 
able compliance improvements this year, despite the public 
sector strike. This suggests that the measures being taken by 
the ministry, as reported in last year’s annual report, are 


beginning to make a difference. 


The Acts require government organizations to issue an 
access decision within 30 days of receiving a request, sub- 
ject to two exceptions. A government organization can 
issue a Notice of Extension to extend the response time 
(section 27(1) of the provincial Act; section 20(1) of the 
municipal Act), and must issue a Notice to Affected Person 
(section 28(1) and section 21(1), respectively) in certain 


circumstances. 
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Provincial: Number of Requests Completed in 2002 (includes only Boards, Agencies and Commissions where the Minister is the Head) 


Ministry Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 days 

Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % 
Agriculture & Food 24 21 19° 905 2 9.5 0 0.0 0 06 
Attorney General/ONAS 345 305 282 925 12 3.9 10 33 1 0.3 
Cabinet Office 43 43 4] 95.4 1 23 0 0.0 1 23 
Citizenship 50 47 28 596 8 17.0 2 4.3 9° 191 
Community, Family & Children's Services | 421 396 200 73.2 68 po 20 5.1 18 45 
Consumer & Business Services 268 259 255 «98.4 2 0.8 2 0.8 OG 60 
Culture 7 4 2 500 1 25.0 oi 25.0 (a0 
Education 30 29 21 72.4 5 17.3 2 6.9 1 3.4 
Energy 17 ll 7 636 1 9.1 1 9.1 2 ie 
Enterprise, Opportunity & Innovation 11 8 8 100.0 0 0.0 0 0.0 0 00 
Environment 4090 449] 1148) 6 1591 35.4 613 13.6 1139-354 
Finance 193 206 153 74.3 26 12.6 8 3.9 19 9.2 
Francophone Affairs 1 2 2° 10020 0 0.0 0 0.0 0 00 
Health and Long-Term Care 2194 1870 1136 607 438 23.4 107 5.7 189° 1041 
Intergovernmental Affairs 4 4 4° 100.0 0 0.0 0 0.0 (5 30m 
Labour 735 726 584 —-80.4 56 7.7 38 52 48 6.6 
Management Board Secretariat 50 43 37 86.0 0 0.0 3 7.0 eee) 
Municipal Affairs and Housing 4] 39 2 eat 11 28.2 1 2.6 pee 51 
Natural Resources 122 122 68 557 37 30.3 10 8.2 TN OSF 
Northern Development and Mines 7 6 6 100.0 0 0.0 0 0.0 (206 
Public Safety and Security 2062 1976 15550. 2 787 252 12.8 87 4.4 Cpe ne al 
Tourism and Recreation 23 24 1338 1 45.8 3 12.5 pee ee 
Training, Colleges and Universities 48 48 ge: 10 20.8 0 0.0 bo 00 
Transportation 270 239 20 2 878 19 7.9 5 ve Ses 


Top Five Municipal Corporations (Population under 50,000) based on numbers of requests completed 


Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 days 
Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % 
Town of Ajax (66,958) 35 34 34 100.0 0 0.0 0 0.0 0 0.0 
Town of Caledon (44,820) 33 33 31 94.0 1 3.0 1 3.0 0 0.0 
Township of Dorion (417) 22 22 22 100.0 0 0.0 0 0.0 0 0.0 
Town of Georgina (35,035) 2 92 90 97.8 1 ah 1 st 0 0.0 
Town of Midland (16,110) 16 16 16 100.0 0 0.0 0 0.0 0 0.0 


22 IPC Annual Report 2002 


Provincial Compliance including Notice of Extension and Notice to Third Parties 
(includes Boards, Agencies and Commissions where the Minister is the Head) 


Ministry 


Compliance including s.27(1) s.28(1) 
% 


Agriculture & Food 

Attorney General/ONAS 

Cabinet Office 

Citizenship/OWD 

Community, Family & Children's Services 
Consumer & Business Services 
Culture 

Education 

Energy 

Enterprise, Opportunity & Innovation 
Environment 

Finance 

Francophone Affairs 

Health and Long-Term Care 
Intergovernmental Affairs 
Labour 

Management Board Secretariat 
Municipal Affairs and Housing 
Natural Resources 

Northern Development and Mines 
Public Safety and Security 
Tourism and Recreation 


Training, Colleges and Universities 


Transportation 


Top Five Municipal Corporations (Population under 50,000) based on number of requests completed 


Compliance including s.20(1) s.21(1) 
% 


Town of Ajax (66,958) 
Town of Caledon (44,820) 
Township of Dorion (417) 
Town of Georgina (35,035) 
Town of Midland (16,110) 
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A Notice of Extension can be issued when: 


© The request is for a large number of records or necessi- 
tates a search through a large number of records and 
meeting the time limit would unreasonably interfere 


with the organization’s operations; or 


¢ Consultations with a person outside the organization 
are necessary to comply with the request and cannot 


reasonably be completed within the time limit. 


A Notice to Affected Person must be issued when the 


record: 


e Might contain information revealing a trade secret or 
scientific, technical, commercial, financial or labour 
relations information that affects the interests of a third 


party; or 


¢ Is personal information that might constitute an unjus- 


tified invasion of personal privacy. 


The legitimate issuance of either Notice means that a govy- 
ernment organization can be in compliance with the Act, 
despite the fact that it takes more than 30 days to respond to 
a request. Accordingly, and in order to more accurately 
reflect actual compliance with the response provisions of the 
provincial Act, the IPC asked ministries to report on the 
number of times they issued these Notices and complied 
with the extended time frames. The chart at page 23 reflects 


compliance figures for provincial ministries that include sec- 
tion 27 and 28 Notices. 


By including these two sections in the compliance equation, 
the provincial compliance figure increases slightly to 58.8 per 
cent from 57.8 per cent. Although this does not represent a 
significant overall improvement, it does make a major dif- 
ference to the compliance rate for a number of individual 
ministries. Perhaps the most dramatic example is the 
Ministry of Natural Resources. Once section 27 and 28 
Notices are accounted for, the ministry’s compliance rate 
increases to 79.5 per cent from 55.7 per cent, an excellent 
achievement. This would appear to substantiate the min- 
istry’s comments last year that the reported figure did not 
adequately account for the high proportion of requests 


requiring section 27 or section 28 Notices. 


After taking into account the impact of section 27 and 28 
Notices, five provincial ministries (in addition to the min- 


istries of Health and Environment) have compliance rates 
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under 70 per cent. All of them deal with a relatively small 
number of requests, but each should give careful consider- 
ation in the upcoming year to identifying ways to improve 
compliance rates. They are the ministries of Citizenship, 
Culture, Energy, Tourism and Recreation, and Municipal 
Affairs and Housing. Since 1999, we have had consider- 
able success in working with institutions to identify ways to 
improve compliance, and would be prepared to do so again 


in the upcoming year. 


MUNICIPAL ORGANIZATIONS 


In recent years, municipal institutions have consistently 
achieved a higher level of compliance with the 30-day 
standard than their provincial counterparts — a trend that 
continued in 2002. Overall, municipal government organiza- 
tions responded to 75.9 per cent of requests within the 


required time frame. 


However, this year’s figure continues another, more wor- 
rying, trend. The overall compliance rate for municipal 
organizations has been in steady decline since reaching 85 
per cent in 1999. Much of this decline can be attributed to the 
performance of one institution, the Toronto Police Services 
Board. Its compliance rate fell from 55.1 per cent in 2001 to 
34.3 per cent in 2002. Even when the section 20 and 21 
Notices are factored in, the compliance rate increases only to 
42.9 per cent. If the Toronto Police Services Board is 
removed from the municipal calculation, the overall compli- 
ance rate for all municipal institutions increases to 84.2 per 
cent. The Toronto Police Services Board had a similar 


impact on overall compliance rates in 2001. 


The accompanying charts provide compliance rates for 
municipal institutions receiving significant numbers of 
requests. As with provincial organizations, we have also 
included separate charts on page 27 that take into account 
the impact of Notices of Extension and Notices to Affected 


Person under section 20 and 21 of the municipal Act. 


Municipalities 

Municipalities have been grouped according to their popula- 
tion. The larger municipalities continued to perform well in 
meeting the 30-day response standard. Most notably, the 
City of Hamilton continued to improve its performance, 
moving up from 61.4 per cent in 2001 to 84.4 per cent in 
2002. The cities of Mississauga and Ottawa and the Regional 
Municipality of York achieved compliance rates in excess of 


90 per cent for the year. 


Small-to medium-sized municipalities continued their out- 
standing performance. Particular recognition should be 
given to municipalities with populations of between 50,000 
and 200,000. Despite receiving significant numbers of 
requests, the top five municipalities in this category all 


attained compliance rates above 97 per cent. 


Police Services 


With the exception of Toronto, police services generally had 
good compliance rates. For the third year in a row, the 
Halton Regional Police Services Board achieved a perfect 
record by responding to 100 per cent of requests within the 
30-day time frame. When section 20 and 21 Notices are 
taken into account, the compliance rate for the Niagara 
Regional Police Services Board increased from an already 


commendable 84.6 per cent to an outstanding 95.5 per cent! 


School Boards 


This year, we have decided to report compliance rates for a 
third category of municipal institutions — school boards. 
Although school boards collectively received a relatively 
modest number of access requests, the board receiving the 
highest volume, Niagara District School Board, achieved a 
perfect response record. The Conseul Scolaire de District du 
Centre Sud-Ouest, fared less well, achieving only a 23.1 per 
cent compliance rate despite responding to a very small 
number of requests. When section 20 and 21 Notices are 
taken into account, the Conseul’s figure rises to a more 


acceptable 69.2 per cent. 
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Top Five Municipal Corporations (Population between 50,000 and 200,000) based on numbers of requests completed 


Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 Days 
Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


City of Kitchener (187,700) 
County of Lambton (126,971) 
Town of Oakville (132,696) 
Town of Richmond Hill (110,160) 
City of Vaughan (160,000) 


Top Five Municipal Corporations (Population over 200,000) based on numbers of requests completed 


Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 Days 
Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


City of Mississauga (623,500) 

City of Ottawa (719,543) 

City of Hamilton (489,457) 

City of Toronto (2,162,147) 

Regional Municipality of York (634,170) 


Top Five School Boards (ranked on numbers of requests completed) 


Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 Days 
Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


Conseil Scolaire de District 
du Centre-Sud-Quest 


Hastings & Prince Edward 
District School Board 


Niagara District School Board 
Ottawa-Carleton District School Board 


Thames Valley District School Board 


Top Five Police Institutions (dased on numbers of requests completed) 


Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 Days 
Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


Durham Regional Police Service 
Halton Regional Police Service 
Hamilton Police Service 
Niagara Regional Police Service 


Toronto Police Service 
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Top Five Municipal Corporations (Population between 50,000 and 200,000) based on number of requests completed 


Compliance including s.20(1) s.21(1) 
% 


City of Kitchener (187,700) 
County of Lambton (126,971) 
Town of Oakville (132,696) 
Town of Richmond Hill (110,160) 
City of Vaughan (160,000) 


Top Five Municipal Corporations (Population over 200,000) based on number of requests completed 


Compliance including s.20(1) s.21(1) 
% 


City of Mississauga (623,500) 

City of Hamilton (489,457) 

City of Ottawa (719,543) 

City of Toronto (2,162,147) 

Regional Municipality of York (634,170) 


Top Five School Boards (based on number of requests completed) 


Compliance including s.20(1) s.21(1) 
% 


Conseil Scolaire de District du Centre-Sud-Quest 
Hastings and Prince Edward District School Board 
Niagara District School Board 

Ottawa-Carleton District School Board 


Thames Valley District School Board 


Top Five Police Institutions (based on number of requests completed) 


Compliance including s.20(1) s.21(1) 
% 


Durham Regional Police Service 
Halton Regional Police Service 
Hamilton Police Service 
Niagara Regional Police Service 
Toronto Police Service 


* Incomplete Statistics 
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The concept of any individual being able to access government-held information is one of the fundamental principles 


of accountable government and participatory democracy. 


This principle is reflected in the provincial and municipal 
Acts, which provide that, subject to limited and specific 
exemptions, information under the control of government 
organizations should be available to the public. Records 
that do not contain the personal information of the 


requester are referred to as “general records.” 


If you make a request under one of the Acts to a provincial 
or municipal government organization, and are not satis- 
fied with the response, you can appeal the decision to the 
IPC. General records appeals can be filed concerning a 
refusal to provide access to general records, the amount of 
fees charged, the fact that the organization did not respond 
within the prescribed 30-day period, or other procedural 
aspects relating to a request. (Appeals relating to requests 
for access to one’s own personal information are covered in 


this annual report in the chapter entitled Privacy.) 


When an appeal is received, the IPC first attempts to settle 
it informally. If all issues cannot be resolved within a rea- 
sonable period of time, the IPC may conduct an inquiry 
and issue a binding order, which could include ordering 
the government organization to release all or part of the 


requested information. 


Overall, 919 appeals regarding access to general records and 
personal information were made to the IPC in 2002, a 
decrease of three per cent from 2001. The overall number 
of appeals closed in 2002 was 837, a decrease of 11 per cent 


from 2001. The decline in the number of appeals closed in 
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2002 is attributable in part to staffing issues at provincial min- 
istries related to a public service strike. A number of appeals 


were also delayed due to an impending court decision. 


ArT RrTPECCe TN RENEDA DErnbDne 
ACCESS TO GENERAL RECORDS 


Appeals Open 
i 


Overall, 569 appeals regarding access to general records 
were made to the IPC in 2002. Of these, 277 (49 per cent) 
were filed under the provincial Act and 291 (51 per cent) 
were filed under the municipal Act. One non-jurisdictional 


general records appeal was made in 2002. 


Of the 277 provincial general records appeals received, 239 
(86 per cent) involved ministries and 38 (14 per cent) 
involved agencies. The Ministry of Health and Long- 
Term Care was involved in the largest number of general 
records appeals (46), followed by the ministries of 
Public Safety and Security (36), Natural Resources (31), 
Environment (27), and Consumer and Business Services 
(24). The agencies with the highest number of general 
records appeals included the Public Guardian and Trustee 
(11), Ontario Lottery and Gaming Corporation (five), 


Centennial College (five), and Ontario Rental Housing 
Tribunal (four). 


Of the 291 municipal general records appeals received, 198 
(68 per cent) involved municipal corporations, 56 (19 per 
cent) involved the police, and 20 (seven per cent) involved 
boards of education. The other 17 (six per cent) appeals 


involved other types of municipal institutions. 


In terms of the issues raised, 44 per cent of appeals were 
related to exemptions claimed by institutions in refusing to 
grant access. An additional eight per cent concerned 
exemptions with other issues. Thirteen per cent were the 
result of deemed refusals to provide access (the institution 
had not responded to the request within the timeframe 
required by the Acts). Eight per cent were third party 
appeals. In about eight per cent of appeals, the issue was 
whether the institution had conducted a reasonable search 
for the records requested. The remaining appeals were 


related to fees, time extensions and other issues. 


While the proportions of each issue in provincial and munic- 
ipal appeals were similar, there were some differences. 
Specifically, appeals filed under the provincial Act were more 
likely to relate to the exemptions claimed and were more 
likely to be third party appeals. Appeals under the municipal 
Act were more likely to be related to deemed refusals, time 


extensions, and requests deemed frivolous and vexatious. 


Provincial institutions with the largest number of deem- 
ed refusal appeals were the ministries of Environment 
and Energy (10) and Health and Long-Term Care (six). 
Municipal institutions with the largest number of such 
appeals included the City of Toronto (18), the Township of 
Stone Mills (five), the City of Stratford (four), the Regional 
Municipality of Niagara (four) and the District Municipality 
of Muskoka (three). No other provincial or municipal insti- 


tution had more than two deemed refusal appeals. 


The largest proportion of appellants was from the business 
sector (39 per cent). (For example, if a company were to 
appeal a denial of access to a competitor’s bid for a govern- 
ment contract, the appellant would be categorized as a 
business.) An almost equal number of appellants were 
individual members of the public (just under 39 per cent). 
Other appellants were categorized as media (10 per cent), 
associations (six per cent), other governments (three per 
cent), unions (two per cent) politicians (one per cent), and 
academics/researchers (one per cent). (With respect to the 
category of government, if a municipality were to appeal a 
decision of a provincial government institution, the appel- 


lant would be categorized as government.) 


Lawyers (101) and agents (nine) represented appellants in 


19 per cent of general records appeals made in 2002. 


In 2002, $9,686 in application fees for general records 
appeals was paid to the IPC. 


Appeals Closed 
The IPC closed 527 general records appeals during 2002. 


Of these, 259 (49 per cent) concerned provincial institu- 
tions and 267 (51 per cent) concerned municipal institu- 


tions. One non-jurisdictional general records appeal was 


closed in 2002. 


Seventy-four per cent of general records appeals were closed 
without the issuance of a formal order. Of the appeals closed 
by means other than an order, two per cent were screened 
out, 68 per cent were mediated in full, 27 per cent were 
withdrawn, two per cent were abandoned, and one per cent 
dismissed without an inquiry. Of the 154 general records 
appeals that were not mediated in full and went on to adju- 


dication, 84 (55 per cent) were mediated in part. 


In comparing the outcomes of provincial and municipal 
appeals, provincial appeals were somewhat more likely to 
be mediated in full and municipal appeals were somewhat 


more likely to be abandoned or withdrawn. 


Of the 527 general records appeals closed in 2002, 18 per 
cent were closed during the intake stage, 53 per cent 
during the mediation stage, and 29 per cent during the 


adjudication stage. 


Of the appeals closed at the intake stage, 91 per cent were 
withdrawn and nearly 10 per cent were screened out. Of 
the appeals closed during the mediation stage, 93 per cent 
were mediated in full, four per cent were closed by issuing 
a formal order, two per cent were withdrawn, and one per 
cent abandoned. Of the appeals closed during the adjudi- 
cation stage, 81 per cent were closed by issuing a formal 
order, 10 per cent were withdrawn, five per cent were 
mediated in full, two per cent were abandoned, and two 


per cent were dismissed without an inquiry. 


In 2002, 27 per cent of general records appeals were closed 
by issuing an order. The IPC issued a total of 134 final 
orders — 77 provincial and 57 municipal.' In addition, the 
IPC issued 22 interim orders — 15 provincial and seven 


municipal.’ 


In the appeals resolved by order, the decision of the head 
was upheld in 31 per cent and partly upheld in 35 per cent 
of cases. The head’s decision was not upheld in about 27 
per cent of the appeals closed by order. The decision of the 
head was upheld or partially upheld in 78 per cent of 


provincial orders and 51 per cent of municipal orders. 
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Issues in General Records Appeals 


Exemptions 


Exemptions with other Issues 


Deemed Refusal 
Reasonable Search 
Interim Decision 
Third Party 

Fees 

Time extension 
Inadequate Decision 
Frivolous/vexatious request 
Transfer 

Other 

Total 


* One additional non-urisdictional appeal was related to other issues. 


Types of Appellants 


Academic/Researcher 
Business 

Government 
Individual 

Media 
Association/Group 
Politician 


Union 


Total 


* An individual filed an additional non-jurisdictional appeal in 2002. 


Appeals closed by interim orders are not usually included in the number of appeals closed by order. 


Provincial 


132 
19 


1 
15 
AL 


Provincial 


% 


47e/, 
6.9 
9.0 
To. 
52 
14.8 
Dh 
1.4 
1.1 


0.4 
3a 
100.0 


% 


1.4 
40.4 
Dal 
28.9 
12.6 
Zo 
1.8 
1.8 
100.0 


Municipal 


118 
28 


Municipal 


291 


% 


40.5 
9.6 
175. 
el 
3.8 
2A 
3.8 
3.8 
0.7 
ay) 


SYD: 
100.0 


% 


38.5 
0.3 
47.8 
6.5 
5.2 
0.3 
1.4 
100.0 


Total 


250 


568* 


The number of appeals closed by order exceeds the number of orders, since three appeals were closed by interim order. 


Overall, the IPC issued a total of 179 final orders — 134 pertaining to access to general records and 45 pertaining to access to 


personal information. Also, the IPC issued 28 interim orders — 22 pertaining to access to general records and six pertaining to 


access to personal information. 
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% 


44.0 
8.3 
13.4 
7.6 
3 
8.3 
3.0 
2.6 
0.9 
2.8 
0.2 
315) 
100.0 


% 


0.7 
39.4 
2.6 
38.6 
Se, 
6.5 
tl 
16 
100.0 


Outcome of Appeals Closed Other Than by Order 


Provincial % Municipal % Total % 


Screened out 
Mediated in Full 
Withdrawn 
Abandoned 

No inquiry 
Total 


* One additional non-jurisdictional appeal was withdrawn in 2002. 


Outcome of Appeals Closed by Order 


Head’s Decision Provincial Municipal 


Upheld 

Partly Upheld 
Not Upheld 
Other 

Total 


* In the three appeals closed by interim order, the head’s decision was partly upheld in one and the other two had other outcomes. 


Outcome of Appeals by Stage Closed 


- Ordered 125 (81.2%) 
Withdrawn 16 (10.4%) 
No Inquiry 3 (1.9%) 
Abandoned 3 (1.9%) 
Mediated in Full 7 (4.5%) 
Total 154 (100.0%) 


Withdrawn 86 (90.5%) 
Screened Out 9 (9.5%) 
Total 95 (100.0%) 


Adjudication 


Mediated in Full 258 (92.8%) 
Withdrawn 5 (1.8%) 
Ordered 12 (4.3%) 
Abandoned 3 (1.1%) 

Total 278 (100.0%) 
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COMPLAINTS 


To protect personal privacy, the provincial and municipal Acts establish rules that govern the collection, retention, use, 


disclosure, security, and disposal of personal information held by government organizations. 


If you believe a provincial or municipal government organi- 
zation has failed to comply with one of the Acts and that your 
privacy has been compromised as a result, you can file a com- 
plaint with the IPC. In the majority of cases, the IPC attempts 
to mediate a solution. The IPC may make formal recommen- 


dations to a government organization to amend its practices. 


Overall, 119 privacy complaints were opened in 2002, up 24 
per cent from 2001. Fifty-nine complaints (50 per cent) were 
filed under the provincial Act and 53 (45 per cent) under the 
municipal Act. Seven non-jurisdictional complaints were 
filed in 2002. Of the 119 complaints opened, 102 (86 per 
cent) were initiated by individuals and 17 (14 per cent) by the 


Commissioner. 


The IPC closed 99 privacy complaints in 2002. These com- 
plaints involved 109 issues. The disclosure of personal infor- 
mation was the most frequent issue, raised in 74 per cent of 
complaints. The collection of personal information was an 
issue in 19 per cent, while the use of personal information 
was an issue in five per cent. Twelve per cent of the com- 
plaints involved other issues, including security, retention, 
disposal, accuracy, access, personal information, notice of 


collection, and general privacy issues. 


Eighty per cent of the issues raised in the privacy complaints 
were disposed of without the need for a formal finding. In 
the remaining cases, institutions were found to have com- 


plied with the Acts in nine per cent and partially complied in 
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one per cent. Institutions were found not to have complied 


with the Acts in 10 per cent of the issues. 


In responding to privacy complaints, the [PC emphasizes 
informal resolution. Consistent with this approach, the 
majority of complaints — 82 per cent — were closed without 
the issuance of a formal privacy complaint report. Fifty-eight 
per cent of complaints were closed during the intake stage. 
(Of these, nine per cent were screened out, five per cent were 
abandoned, 23 per cent were withdrawn, and 63 per cent 
were resolved informally.) Forty-two per cent of complaints 
proceeded to the investigation stage. Of the complaints 
closed during the investigation stage, two per cent were 
abandoned, 55 per cent were settled and 43 per cent were 
closed by issuing a report. Eighteen privacy complaint 
reports were issued in 2002. These reports contained 27 rec- 


ommendations to government organizations. 


PERSONAL INFORMATION APPEALS 


The Acts also provide a right of access to and correction of 
your personal information. If you make a request under 
one of the Acts to a provincial or municipal government 
organization for your personal information, and you are 
not satisfied with the response, you can appeal the decision 
to the IPC. Personal information appeals can be filed con- 
cerning a refusal to provide access to your personal infor- 
mation, a refusal to correct your personal information, the 
amount of fees charged, the fact that the organization did 
not respond within the prescribed 30-day period, or other 
procedural aspects relating to a request. (Appeals relating 
to requests for access to general records are covered in the 


chapter entitled Access.) 


2001 Privacy Complaints 2002 Privacy Complaints 


Provincial Municipal Non-urisdictional Total Provincial Municipal — Non-jurisdictional Total 


Privacy Complaints by Type of Resolution 


Provincial % Municipal % Non-urisdictional % Total % 


\ Screened out 
Abandoned 
Withdrawn 
Settled 


a> Geer 


Informal Resolution 
Report 
Total 


: Privacy Complaints By Type of Resolution and Stage Closed 


Intake % Investigation % Total % 
Screened out eee Da 
Abandoned 
Withdrawn 
Settled 
Informal Resolution 
Report 
Total 


Issues* in Privacy Complaints 
Provincial % Municipal % Non zurisdictional % Total = % 

Disclosure 
Collection 
Use 
Security 
Retention 
Disposal 
Accuracy 
Access 

_ Personal Information 
Notice of Collection 
General Privacy 


Total 


* The number of issues does not equal the number of complaints closed , as some ¢ 


V “oni el 


omplaints may involve more than one issue. 
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When an appeal is received, the IPC first attempts to settle 
it informally. If all the issues cannot be resolved within a 
reasonable period of time, the IPC may conduct an inquiry 
and issue a binding order, which could include ordering the 
government organization to release all or part of the 


requested information. 


STATISTICAL OVERVIEW 


Overall, 919 appeals regarding access to personal information 
and general records were made to the IPC in 2002, a decrease 
of three per cent from 2001. The overall number of appeals 
closed in 2002 was 837, a decrease of 11 per cent from 2001. 
The decline in the number of appeals closed in 2002 is 
attributable in part to staffing issues at provincial ministries 
related to a public service strike. A number of appeals were 


also delayed due to an impending court decision. 


ACCESS AND CORRECTION 
OF PERSONAL INFORMATION 


Appeals Open 


In 2002, 350 appeals regarding access or correction of per- 
sonal information were made to the IPC. Of these, 145 (41 
per cent) were filed under the provincial Act and 203 (58 per 
cent) under the municipal Act. Two non-jurisdictional per- 


sonal information appeals were made. 


Of the 145 provincial personal information appeals 
received, 117 (81 per cent) involved ministries and 28 
(19 per cent) involved agencies. The Ministry of Public 
Safety and Security was involved in the largest number of 
personal information appeals (74), followed by the 
ministries of the Attorney General (11), Health and 
Long-Term Care (nine), Transportation (five), Consumer 
and Business Services (four), and Finance (four). The 
agencies with the highest number of personal information 
appeals included the Ontario Human Rights Commission 
(12), the Ontario Rental Housing Tribunal (three), the 
Ontario Civilian Commission on Police Services (two), 
the Ontario Lottery and Gaming Corporation (two), and 
the Workplace Safety and Insurance Board (two). 


Of the 203 municipal personal information appeals 
received, 137 (67 per cent) involved the police, 42 (21 per 
cent) involved municipal corporations, and 15 (seven per 
cent) involved boards of education. Nine appeals (four per 


cent) involved other types of municipal institutions. 
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Fifty-three per cent of personal information appeals were 
related to exemptions claimed by institutions in refusing 
to grant access. An additional nine per cent concerned 
exemptions plus other issues. Eleven per cent of the 
appeals were the result of deemed refusals to provide 
access, in which the institution did not respond to the 
request within the time frame required by the Acts. In 
about 12 per cent of appeals, the issue was whether the 
institution had conducted a reasonable search for the 
records requested. Three per cent of appeals related to 
correction requests, while the remaining appeals were 


related to fees, time extensions or other issues. 


In comparing where municipal and provincial appeals 
differed somewhat, provincial personal information 
appeals were more likely to involve exemptions, reason- 
ableness of search, and frivolous or vexatious requests, 
while municipal personal information appeals were more 
likely to involve deemed refusals to provide access and 


time extensions. 


Of the provincial institutions, the Ontario Human Rights 
Commission had the highest number of deemed refusals 
(four). The Workplace Safety and Insurance Board and 
the Attorney General each had two deemed refusal 
appeals. Of the municipal institutions, the Toronto Police 
Services Board had six deemed refusal appeals while the 
Ottawa Police Service had five. The Hamilton Police 
Service had four and the Sudbury Regional Police Service 
had two. No other provincial or municipal institution had 
more than one deemed refusal appeal pertaining to per- 


sonal information. 


Since personal information appeals, by definition, relate 
to a request for access and/or correction of one’s own per- 
sonal information, all appellants were categorized as indi- 
viduals. Lawyers (100) or agents (seven) represented 
appellants in 31 per cent of the personal information 


appeals made in 2002. 


In 2002, $12,156 in application fees for personal informa- 
tion appeals was paid to the IPC. 


Number of Privacy Complaints Closed 1998-2002 


Provincial Municipal Non urisdictional Total 
1998 a2 54 96 
1999 40 48 88 
2000 39 41 2 82 
2001 61 28 6 95 
2002 54 38 7. 2) 


Outcome of Issues* in Privacy Complaints 


Provincial % Municipal % Non-jurisdictional % Total % 
Did not comply with the Act 7 123 4 8.9 1] 10.1 
Complied with the Act 4 7.0 6 13.3 10 Ip 
Partially complied ] 22 1 0.9 
Act does not apply 10 175 4 Sy 14 12.8 
Resolved — Finding not necessary 34 59.6 34 75.6 See 4a 2 71 65.1 
Unable to conclude 2 oS) 2 1.8 
Total 57 100.0 45 100.0 7 100.0 109 100.0 


* The number of issues does not equal the number of complaints, as some complaints may involve more than one issue. 


Source of Complainants 


Provincial % Municipal % Non-jurisdictional % Total % 
Individual 4} L949 34 89.5 7 100.0 82 82.8 
IPC Commissioner Initiated 13 241 4 10.5 1 172 
Total 54 100.0 38 100.0 7 100.0 99 100.0 
Issues in Personal Information Appeals 
Provincial % Municipal % Total % 
Exemptions 78 53.8 107 yey) 185 Sy 
Exemptions with other Issues 14 9.6 1g 8.9 32 9.2 
Deemed Refusal 13 9.0 25 12.3 38 10.9 
Reasonable Search 22 152 20 9.9 42 121 
Interim Decision I 0.7 1 0.3 
Third Party 1 0.5 1 0.3 
Fees Z es 2 1.0 e el 
Time extension 3 1.5 3 0.9 
Inadequate Decision 
Frivolous/vexatious request 3 2.1 1 0.5 4 1.1 
Transfer 
Correction 4 De. 5 2 9 2.6 
Other 8 SS. 21 10.3 29 8.3 
Total 145 100.0 203 100.0 348* 100.0 


* The issues in two additional non-jurisdictional personal information appeals were filed in 2002 were deemed refusal and other issues. 
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Appeals Closed 

The IPC closed 310 personal information appeals during 
2002. Of these, 131 (42 per cent) concerned provincial 
institutions, while 177 (57 per cent) concerned municipal 
institutions. Two non-jurisdictional personal information 


appeals were closed in 2002. 


Eighty-four per cent of personal information appeals were 
closed without the issuance of a formal order. Of the 
appeals closed by means other than an order, seven per 
cent were screened out, 56 per cent were mediated in full, 
32 per cent were withdrawn, four per cent were aban- 
doned, and one per cent dismissed without an inquiry. Of 
the 56 personal information appeals that went on to adju- 


dication, 28 (50 per cent) had been mediated in part. 


Of the 310 personal information appeals closed in 2002, 33 
per cent were closed at the intake stage, 49 per cent at the 


mediation stage and 18 per cent at the adjudication stage. 


Of the appeals closed at the intake stage, 75 per cent were 
withdrawn, 19 per cent were screened out and six per cent 
abandoned. Of the appeals closed at the mediation stage, 
97 per cent were mediated in full, two per cent were with- 
drawn, and one per cent abandoned. Of the appeals closed 
during the adjudication stage, 88 per cent were closed by 
issuing a formal order, five per cent were withdrawn, four 
per cent were abandoned, and four per cent were dis- 


missed without an inquiry. 


In 2002, 16 per cent of personal information appeals were 
closed by issuing an order. The IPC issued a total of 45 
final orders for personal information appeals — 13 provin- 
cial and 32 municipal’. In addition, the IPC issued six 


municipal interim orders. 


In personal information appeals resolved by order, the 
decision of the head was upheld in 65 per cent and partly 
upheld in 25 per cent. The head’s decision was not upheld 
in about only four per cent of the personal information 
records appeals closed by order. Six per cent of the orders 
issued in 2002 had other outcomes. In comparing the out- 
comes of provincial and municipal orders, the decision of 
the head was more likely to be upheld in provincial orders, 
and more likely to be partly upheld or not upheld in 


municipal orders. 
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The number of appeals closed by order exceeds the number of orders, 
since one order closed two appeals, one appeal was closed by an interim 
order, and two appeals were closed by reconsideration orders. Appeals 
closed by interim orders and reconsideration orders are not usually 


included in the number of appeals closed by order. 


Outcome of Appeals Closed by Order 


Municipal 


Head’s Decision 


Upheld 21 


Partly Upheld 9 


Not Upheld 2 
Other 3 


Total 35 


Provincial 


Head’s Decision 


Upheld 11 
Partly Upheld 3 
Not Upheld 0 
Other 0 

Total 14 


Outcome of Appeals by Stage Closed 


Ordered 49 (87.5%) 
Withdrawn 3 (5.4%) 
No Inquiry 2 (3.6%) 
Abandoned 1 (1.2%) 
Total 56 (100.0%) 


Successfully Mediated 146 (96.7%) 


Withdrawn 3 (2.0%) 


Abandoned 2 (1.3%) 
Total 151 (100.0%) 


Outcome of Appeals Closed Other Than by Order 


Municipal 


Successfully Mediated 80 
Withdrawn 47 


Screened Out 9 


Abandoned 5 


No Inquiry 1 


Total 142 


Provincial 
Successfully Mediated 66 
Withdrawn 35 


Screened Out 10 


Abandoned 5 


No Inquiry 1 
Total 117 


*One additional non-jurisdictional appeal was screened out and another withdrawn in 2002 


Withdrawn 77 (74.8%) 
Screened Out 20 (19.4%) 
Abandoned 6 (5.8%) 
Total 103(100.0%) 
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more high profile than others because they attract significant media attention, touch on novel 


hire (6 aro ce ll Wexoye arare oe Sate AS ey RIGA iam Da ene Nia tpenice 11 even ENERGIA LET AA AP aicmlACAr falas melbhinand: 
nvolving allegations that personal iInrormation Was Inappropriately Collected, USEC OF C isclosed. These included: 


In early 2002, the IPC conducted a privacy review of the 
Chatham-Kent IT Transition Pilot Project. This project 
involves testing the use of information technology in a pri- 
mary care environment. The ePhysican Project, a collabo- 
rative effort of the Ministry of Health and Long-Term 
Care, the Ontario Family Health Network and the 
Ontario Medical Association, is supporting the Chatham- 
Kent Project. Smart Systems for Health (SSH), an office 
within the Ministry of Health, is providing the infrastruc- 
ture for the collection, storage, transmission and exchange 
of personal health information, including a secure server 
environment for hosting the personal health information 


of patients. 


The IPC review was initiated after a newspaper cited allega- 
tions that there were serious privacy problems with the 
project. The IPC found that the major allegations were gen- 
erally unfounded, but made a series of recommendations, 
including that SSH examine the feasibility of encrypting the 
personal health information databases stored on its server, 
and that it consider implementing further privacy- 
enhancing technologies, such as pseudonymizing tools and 
encrypted relational databases. The IPC also recommended 
that SSH conduct an end-to-end security test of the entire 
network, and that the ePhysician Project prepare a fact sheet 
on the Chatham-Kent Project that could be made available 


to patients. 
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Ail od 


The University Health Network (UHN) is composed of 
three hospitals: Toronto General, Toronto Western and 
Princess Margaret. In May 2002, two well-known individ- 
uals checked into the UHN hospital system for treatment. 
When UHN ran audits on the two patients’ electronic 
health records, it discovered that a small number of staff 
and medical residents had accessed the records of the two 
well-known patients, even though they did not appear to 
be involved in the care provided to these patients. 
Although the IPC does not have jurisdiction over the gen- 
eral hospital sector, UHN’s chief executive officer 
requested that our office conduct a privacy assessment of 
his institution’s response to the apparent breaches of 


patient privacy. 


The IPC’s assessment concluded that UHN was making 
considerable efforts to ensure that the privacy breaches that 
occurred do not happen again. For example, after discov- 
ering the apparent breaches of patient privacy, UHN con- 
ducted a series of swift inquiries and took disciplinary action 
against the individuals who were found to have inappropri- 
ately accessed the electronic patient records. It also asked an 
independent third party to conduct a review of its overall 
privacy practices, and enhanced the privacy training pro- 
vided to staff and medical residents. The IPC recommended 
that UHN finalize and approve its draft privacy policy no 
later than October 1, 2002, and that UHN propose to the 
University of Toronto’s Faculty of Medicine and other 
Ontario medical schools that the undergraduate curriculum 
for medical students include at least eight hours of lectures 


and workshops run by privacy specialists. 


CITY OF HAMILTON (MC-020017-1) 


The IPC was notified by the administrator/owner of a residential 
care home licensed by the City of Hamilton that, during the 
course of their inspections, city inspectors reviewed the medical 
and personal care plan records of the tenants and took notes from 
those records, all without notice to the residents and without 
their consent. The IPC was also contacted by a number of other 
individuals expressing the same concerns but regarding another 
facility. As a result, the IPC initiated a privacy investigation to 
determine whether the city’s collection practices were in accor- 


dance with the privacy provisions of the Act. 


The investigation concluded that the city’s collection of the ten- 
ants’ personal information was for the purpose of municipal 
bylaw enforcement activities and therefore in compliance with 
the Act. Further, since the collection of the tenants’ personal 
information was used for the purpose of law enforcement, the Act 
permits the city to collect the information indirectly, through 
inspection of the tenants’ files. However, the IPC found that the 
city had not provided the tenants with proper notice before col- 


lecting their personal information. 


The city acknowledged that it had not complied with the notice 
provisions of the Act and agreed that it would ensure that opera- 
tors of residential care facilities permanently post appropriate 
written notice in a highly visible location; provide letters to the 
operators of each of the city’s licensed residential care facilities 
explaining the collection process; require operators to provide 
new tenants with a one-time written notice; and require opera- 
tors to ensure that only those records and reports listed in the 


bylaw will be placed in the tenants’ files for inspection by the city. 


In addition, we recommended that the city provide proper notice 
to tenants within a reasonable period of time whenever it 
inspected a facility and collected their personal information, 
unless an exception in the Act applied. Finally, we recommended 
that the city review the specific types of information currently 
listed in the bylaw to ensure that all of the personal information 


listed is necessary for realizing the purpose of the bylaw. 


MINISTRY OF HEALTH AND LONG-TERM CARE 
(PC-020014-1) 

At the request of the ministry, the IPC initiated a privacy inves- 
tigation after Ontario Public Service Employee Union (OPSEU) 
members reported that they found papers scattered on the floors 
of rooms in the old Whitby Mental Health Centre (WMHC) that 
appeared to contain the personal information of both staff and 
patients. The records had apparently been left behind when the 
WMHC moved to its new location. OPSEU also claimed that 
there was reason to believe that additional ministry records con- 
taining personal information still remain in the building and 


other buildings located on the old WMHC site. 


The IPC’s investigation concluded that many of the records 
retrieved by OPSEU contained personal information, and that 
the disclosure and disposal of this personal information was not 


in compliance with the Act. 


During the course of the investigation, the ministry informed the 
IPC that it was having difficulty obtaining the landlord’s permis- 
sion to enter the old WMHC site and search for and retrieve any 
additional records that may have been left behind. Accordingly, 
our first recommendation was that the ministry seek a court 
order to recover and secure any records remaining in the old 
WMHEC site. We also recommended, subject to exceptional cir- 
cumstances which may prevent notification, that the ministry 
notify all individuals whose personal information was contained 
in the records; that it establish an ongoing program of privacy 
and security training for its managers and staff; and that it review 
its policies and procedures for the protection and secure disposal 


of personal information. 
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In 2002 


. 2002, the courts rendered several decisions that finalized a number of issues of importance to freedom of informa- 


tion and privacy in Ontario. Several other issues are still outstanding, as the relevant decisions are the subject of appli- 


cations for leave to appeal to higher courts. 


(1) In the 2001 annual report, we described two Divisional 
Court rulings that upheld IPC orders on a “reasonableness” 
standard of review. These were challenged by the relevant 
ministries during 2002. In one case, which involved the 
Ministry of Health and Long-Term Care, the IPC had found 
that records listing the top 10 items billed by an unnamed 
physician did not contain personal information and must be 
disclosed. The ministry challenged the Divisional Court's 
ruling, but the Court of Appeal dismissed this appeal with 
costs to the requester, payable by the ministry. The higher 
court confirmed that the proper standard of review on appli- 
cations for judicial review was reasonableness and that the 
decision that the affected person was not identifiable in the 


circumstances was reasonable. 


(2) The second case of this nature that was referred to 
in our 2001 annual report involved Ontario’s Public 
Guardian and Trustee. The IPC ordered it to disclose a 
listing of individuals who had died intestate, including 
their names, addresses, dates and places of death, and last 
occupations. In this case, the IPC found that disclosure 
would not cause pecuniary harm to affected persons, but 
would, in fact, benefit unknown heirs by making addi- 
tional resources available to locate and assist them in 
claiming their inheritances. Accordingly, disclosure was 
not an unjustified invasion of privacy of the deceased indi- 
viduals. This decision is now final as the ministry’s appli- 
cation for leave to appeal to the Court of Appeal was 
dismissed in 2002. 
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(3) Closure has been brought to a jurisdictional issue that 
arose from the passage of the Labour Relations and 
Employment Statute Law Amendment Act, 1995 (Bill 7). 
That law amended the Freedom of Information and 
Protection of Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act (the Acts) in order 
to exclude a significant amount of employment and labour 
relations information from their coverage. The IPC’s 
interpretation of the scope of the Bill 7 exclusionary 
amendments was upheld by the Divisional Court in 2000. 
However, in 2001, the Court of Appeal reversed the 
Divisional Court and overturned the IPC’s rulings. The 
Court rejected the IPC’s requirement that the government 
show a “current legal interest” in the subject matter of the 
record in order for the exclusions to apply. Consequently, 
records that the IPC had ruled were subject to the provin- 
cial Act were found by the Court of Appeal to be excluded. 
In 2002, the Supreme Court of Canada rejected the IPC’s 
application for leave to appeal that decision, thereby 
entrenching a broad exclusion of employment and labour 


relations information from the Acts’ coverage. 


(4) In a case where the proper interpretation of an access 
request was at issue, the Divisional Court referred the matter 
back to the IPC, after deciding that the interpretation that 
the IPC had applied was too narrow and therefore unrea- 
sonable. Also of interest was the Court’s consideration of the 
role of counsel for the IPC. The Court ruled that the IPC 
had standing to deal with the issue of the reasonableness of 
its decision and any questions of jurisdiction and, accord- 


ingly, did not limit the role of counsel. 


(5) Ina case where the Toronto District School Board chal- 
lenged the IPC’s decision that it had jurisdiction to order 
the release of the board’s representations, under section 
41(13) of the municipal Act, the Divisional Court disagreed 
with the board. The Court confirmed the IPC’s discre- 
tionary power to order the exchange of representations 
between the parties to appeals. Further, it strongly 
endorsed the guidelines developed by the IPC, which 
include confidentiality criteria that limit the exchange of 
representations in certain circumstances. This decision 
should promote greater co-operation with the IPC in its 
dealings with parties at the inquiry stage of appeals, 
because it confirms the importance and propriety of some 
degree of mutual disclosure of the arguments and evidence 


of all parties. 


Outstanding Judicial Reviews as of December 31, 2002: 27 
Launched by: 


Institutions: 18 


Requesters: 8 


Institution & Affected Parties: | 


New applications received in 2002: 17 


Judicial Reviews Closed/Heard in 2002: 25 


Abandoned (IPC Order Reconsidered): 6' 


Abandoned (Order Stands): 9" 


Heard but Not Closed (subject to appeal): 3" 


Matter Remitted Back to IPC: 1” 


IPC Order Upheld: 2 * 


IPC Order Upheld in Part: 1” 


IPC Order Not Upheld: 3 “" 


(6) The Divisional Court overturned the IPC’s decision 
denying a media requester access to an electronic database 
containing the names and addresses of all contributors to 
candidates for the 1997 City of Toronto municipal election. 
A provision of the Municipal Elections Act required the city 
clerk to permit inspection and copying of the hardcopy 
paper records of candidates’ financial reports containing this 
same information at the clerk’s office during regular busi- 


ness hours. 


The IPC held that the physical inspection scheme repre- 
sented the extent of the city’s obligation and that electronic 
disclosure was an unjustified invasion of personal privacy, 
because of the dangers mass electronic dissemination posed 
for unauthorized data-matching, profiling, identity theft, 
fraud, stalking and harassment. The Court disagreed, 
holding that disclosure of the entire database was necessary 


for public scrutiny of the election process. 


Abandoned: IPC Order Reconsidered: MO-1447, PO-1696, 
PO-1718, PO-1782, PO-1797, PO-1863 
Abandoned: IPC Order Stands: MO-1548, PO-1961-I, PO-1896, 
PO-1936, PO-1973, PO-1974, PO-1975, PO-1976, PO-1977 
Heard but Not Closed: PO-1561/R-980036, PO-1721, MO-1366 
Matter Remitted Back to IPC: PO-1944 

* IPC Order Upheld: PO-1736/P0-1790-R, PO-1880 
IPC Order Upheld in Part: MO-1521-I 

' IPC Order Not Upheld: P-1618, P-1627, PO-1658 
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One of the key responsibilities of the IPC is to help educate 
the public about its access and privacy rights. The IPC 
reaches out across Ontario through a variety of programs 
it has created to answer specific questions and to generate 
interest in freedom of information and protection of pri- 
vacy. A number of the outreach initiatives are based on a 
key premise: Teach the Teacher. The IPC focuses on 
making presentations to, and creating resources for, pro- 
fessionals in a number of key fields. One of the largest out- 
reach initiatives is the school program. Other initiatives 
include programs involving the media, librarians, lawyers 


and provincial and municipal civil servants. 


Each initiative is based on one or more of the five core ele- 
ments in the outreach program: the School program, the 
Speeches and Presentations program, the Publications pro- 


gram, Media Relations and the IPC Web site. 


The IPC’s highly successful school program, What Students 
Need to Know About Freedom of Information and Protection 
of Privacy, focuses on the grade where students first learn 
about government (Grade 5) and the compulsory Grade 10 
civics program. The third element of the program makes 


additional resources available to Grade 11 and 12 teachers. 


The special teacher’s guide developed for Grade 5 social 
studies teachers by the IPC (with the help of curriculum spe- 
cialists and classroom teachers) includes a number of lessons 
and background material for in-class discussion and study of 
why freedom of information and protection of privacy are 


important. 
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The Grade 10 teacher’s guide, which includes a privacy 


quiz and material for a discussion on open government, — 


provides the foundation for students to discuss why these — 
two values are important and how these values are | 


reflected in our relationship with government. 


The Grade 11-12 teacher’s guide, added at the suggestion of © 
secondary school curriculum consultants, provides resources © 


that teachers can use in such courses as Canadian law. 


During 2002, the IPC made presentations about its school | 
program to history and social studies consultants at seven 
school boards. And, IPC staff made more than 50 presen- 
tations to Grade 5 social studies classes as part of its Ask an 


Expert program. 


All three guides — and brochures outlining each of them —are | 


available on the IPC’s Web site (www.ipc.on.ca/#education). 


Commissioner Ann Cavoukian delivered 31 presentations 
in 2002. She was a keynote speaker at a number of major 


conferences and also made special presentations at univer- 


sities and to various groups. Among these were presenta- 
the 


Communicators, the Conference Board of Canada and the 


tions to International Association of Business 
Toronto Board of Trade. She was a keynote speaker at the 
International Association of Privacy Officers Conference 
and at the third annual Privacy and Security Workshop, 
Privacy and Security: Totally Committed, jointly sponsored 
by the IPC and the Centre for Applied Cryptographic 
Research at the University of Waterloo. Among her other | 
presentations were those to Comdex/Canada 2002, 
Communications and Information Technology Ontario 
(CITO), and a privacy summit in Toronto organized by | 


IBM’s Tivoli division. Among her presentations to faculty 


and students were presentations at McMaster University, 
the University of Toronto, the University of Waterloo and 


Dalhousie University. 
Other segments of the IPC’s speakers’ program include: 


e the Reaching out to Ontario program, under which a 
small team of speakers — led by the Commissioner or the 
Assistant Commissioner — visit a region of Ontario and 
make 10 to 12 presentations to various groups over one 
or two days. In 2002, IPC teams visited Barrie/Orillia, 
Mississauga, Sault Ste. Marie and Windsor; 


¢ a university program, where members of the IPC’s 
Legal and Policy Departments make presentations to 
faculty and students in business, technology and law 


programs, 


e a general public speaking program, where IPC staff 
make presentations on access and privacy to various 
groups or organizations. Presentations in 2002 included 


speeches to a wide array of health organizations; 


¢ a media program, where the IPC’s Communications 
Co-ordinator addresses college and university jour- 
nalism or electronic media classes, and workshops at 


newspapers and other media. 


IPC PUBLICATIONS 


The IPC released 15 print publications or major submis- 
sions in 2002, covering a wide spectrum of privacy and 
access topics. Among these was a paper that promotes 
redesigning security technologies to enhance privacy, 
rather than threaten it: Security Technologies Enabling 
Privacy (STEPs): Time for a Paradigm Shift. Two of the 
publications were major IPC reviews that dealt with the 
privacy of personal information stored in electronic 
format, including: Privacy Assessment: The University 
Health Network's Response to Recent Breaches of Patient 
Privacy, and Privacy Review: Chatham-Kent IT Transition 
Pilot Project. Some papers were aimed directly at govern- 
ment organizations, including: Opening the Window to 
Government: How e-RD/AD Promotes Transparency, 
Accountability and Good Governance; Processing Voluminous 
Requests: A Best Practice for Institutions; and Exercising 
Discretion under section 38(b) of the Municipal Freedom of 


Information and Protection of Privacy Act. 


There were also two new papers in the IPC’s popular 
If you wanted to know...series, one of which looks at the 
most frequently asked questions the IPC receives; while 
the other deals with privacy issues related to libraries. As 
well, the IPC produced the first two issues of Mediation 
Works!, an e-newsletter created by the Tribunal Services 
Department to promote mediation to access and privacy 


professionals in the public sector. 


During 2002, 13,731 copies of IPC publications were dis- 
tributed at conferences or mailed out in response to 


requests. 


A full list of the print publications released by the IPC in 
2002 follows this Outreach report. 
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MEDIA RELATIONS 


As part of its pro-active media relations program, the IPC 
tries to raise the media’s consciousness about access and 
privacy issues. It does this through meetings with the edi- 
torial boards of newspapers (there were four such meetings 
in 2002), presentations to newsrooms and media students, 
through on-site interviews at television and radio stations 
during Reaching Out to Ontario initiatives, and through 


news releases and publications. 


The IPC is also frequently contacted by the media seeking 
interviews, or with questions about freedom of informa- 
tion or privacy issues or processes. The Commissioner 1s 
the official spokesperson for the IPC and accepts as many 
requests for interviews as her schedule allows. During 
2002, the Commissioner gave 57 interviews — to Ontario, 
Canadian and international newspaper, TV, radio, maga- 
zine and online reporters. Overall, the IPC assisted more 
than 120 reporters seeking interviews, basic facts or back- 


ground information. 


IPC WEB SITE 


Another main element of the Outreach program is the 
IPC’s Web site, which offers a wide range of information 
about access and privacy issues and legislation. All IPC 
publications and orders are available on the site. You will 
find answers to common questions about access or privacy 
—and about the IPC — in reader-friendly brochures. Plus, 
there are copies of the two Acts, educational material, 
selected speeches and other presentations by IPC staff, 
news releases, forms, and much more. One section offers 


links to other Web sites that focus on access and/or privacy. 


For more detailed information about the IPC’s Web site 


(www.ipc.on.ca), see the chapter that follows Publications. 
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FACE TO FACE 


To get IPC publications and other information into the 
hands of Ontarians, the IPC sets up an information table at 
a number of conferences. These range from public meet- 
ings or conferences organized by the IPC itself (such as the 
annual Privacy and Security Workshop the IPC co-spon- 
sors with the University of Waterloo, which attracted an 
overflow crowd last November from all over North 
America) or has speakers at (such as Management Board’s 
annual access and privacy conference), to major confer- 
ences of organizations that the IPC wants to reach. For 
example, in 2002 the IPC set up information tables and 
handed out publications (and buttons to those who scored 
well in the IPC’s access and privacy quizzes) at the annual 
conference of the Association of Municipalities of Ontario 
and the combined conference of the Rural Ontario 


Municipalities and the Ontario Good Roads Association. 


Among other highly successful events during 2002 was a 
continuing legal education program, Open Government: 
Freedom of Information Law in Ontario, co-sponsored by 
the IPC, the Ministry of the Attorney General and the 
Ontario Bar Association. The keynote speaker was the 
Honourable Sidney Linden, who was Ontario’s first 


Information and Privacy Commissioner. 


The IPC’s publications program is one of the primary ways it provides information about specific access or privacy issues 
to government organizations and the public. As well as its annual report and two newsletters, the IPC produces a 


number of policy papers, brochures and specialty publications each year. 


The print publications and major submissions released in ¢ Commissioner Ann Cavoukian’s annual report for 2001; 


2002, in order of publication, included: 


¢ Submission to the Standing Committee on General 


¢ Exercising Discretion under section 38(b) of the Municipal Government regarding Bill 58, An Act to amend certain 


Freedom of Information and Protection of Privacy Act, 
which provides institutions with an outline of what 
constitutes a valid exercise of discretion in the applica- 
tion of section 38 (b), and some practical tips on how to 
properly exercise discretion when dealing with a spe- 
cific category of records. It was co-produced by the 
Toronto Police Service and the IPC; 


Submission to the Ministry of Consumer and Com- 
mercial Relations in Response to A Consultation Paper: 
Proposed Ontario Privacy Act; 


If you wanted to know... What are the 15 most frequently 
asked questions the Information and Privacy Commissioner 
receives ?; 


The Spring 2002 edition of the IPC’s bi-annual 
newsletter, IPC Perspectives; 


Privacy Review: Chatham-Kent IT Transition Pilot 
Project, a review by the IPC of this online health- 
information pilot project; 


Security Technologies Enabling Privacy (STEPs): Time 
for a Paradigm Shift, discusses how many security 
technologies can be redesigned to minimize or elimi- 
nate their privacy invasive features, yet remain highly 
effective tools; 


Opening the Window to Government: How e-RD/AD 
Promotes Transparency, Accountability and Good 
Governance, which outlines how governments can use 
electronic routine disclosure and active dissemination 
techniques to further the goals of open government; 


statutes in relation to the energy sector; 


Privacy Assessment: The University Health Network's 
Response to Recent Breaches of Patient Privacy. This 
IPC report reviews the UHN’s efforts to ensure that 
the inappropriate access of electronic patient records 
that occurred in May 2002 would not reoccur; 


Processing Voluminous Requests: A Best Practice for 
Institutions provides strategies to assist institutions in 
processing voluminous requests. This paper was a 
joint project of the IPC and the Information and 
Privacy Unit of the Ministry of Natural Resources; 


Privacy and Digital Rights Management (DRM): An 
Oxymoron outlines the factors that gave rise to DRM 
technology, the impact of DRM on the privacy rights 
of consumers, and proposes how to embed privacy 
into DRM technologies. It also offers privacy tips to 


consumers; 
The Fall 2002 edition of IPC Perspectives; 


If you wanted to know... What are the privacy responsibili- 
ties of public libraries? the latest in the IPC’s If you 
wanted to know...series, looks at some common ques- 
tions library users and library staff may have about pri- 
vacy rights and what libraries can do to protect privacy; 


Concerns and Recommendations Regarding Government 
Public Key Infrastructures for Citizens examines the 
potential impact of PKI on the protection of personal 
privacy and makes recommendations for officials estab- 
lishing such systems. 


IPC publications are available on the IPC’s Web site (www.ipc.on.ca) or by calling the 
Communications Department at 416-326-3333 or 1-800-387-0073. 
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It serves a variety of audiences — from professionals 
in the privacy or freedom of information sectors to 
teachers, from concerned individuals to students, from 
human resources professionals to reporters, from 


researchers to lawyers. 


The site was recently redesigned to make it even more 
user friendly. The IPC continually reviews and 
improves the functionality of the Web site and feed- 


back from users is important. 


One of the new features is a topic section organized by 
subject, to make ‘it easier for visitors to find relat- 
ed information on a major topic, such as identity theft. 
This section can be accessed through the new Topics 
link, which also includes a Hot Topics section. Another 
new feature is a location bar that automatically updates 
as you move through sections, so you always know 


where you are at on the Web site at any time. 


The IPC added a wide variety of new information 
resources to the site in 2002, including 17 new publi- 
cations, copies of a number of speeches or presenta- 
tions made by IPC staff, all the orders that were issued 
in 2002, privacy investigation reports and a wide array 
of other information. A new IPC poster, entitled 7 
Essential Steps for Designing Privacy into Technology, 
takes you through the essential steps for building pri- 
vacy into technology. (You will find this in the 


Resources section.) 
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c library that offers extensive resources 


In 2002, approximately 250,000 people visited the Web 
site and viewed nearly one-million pages of informa- 
tion. Some visitors did their research online, others 
downloaded a variety of IPC publications, reports or 


forms. There were 108,919 separate downloads last year. 


Consistent with the IPC’s mandate to promote routine 
disclosure, all IPC orders are posted to the Web site. 
The Orders, Complaint Reports and Judicial Reviews 
section is always one of the most accessed portions of 
the site. Links to newly posted orders can also be 


found on the What's New page. 


For those downloading material, the most popular 
publication last year was the Privacy Diagnostic Tool. \t 
was downloaded 5,288 times (4.85 per cent of all 


resources downloaded). 


Other popular resources in 2002 included Consumer 
Biometric Applications: A Discussion Paper; Workplace 
Privacy: A Consultation Paper; the IPC’s Submission to the 
Ministry of Consumer and Business Services: Consultation 
Draft of the Privacy of Personal Information Act, 2002, and 
the IPC’s three teachers’ guides. 


The IPC is constantly updating and improving the 
resources available on its Web site. Questions and 
feedback are always welcome. Please address com- 


ments to: 


Part of the mandate of the IPC under the Freedom of Information and Protection of Privacy Act is to offer comment on 


the privacy protection and access implications of proposed government legislative schemes or government programs. 


We take this mandate very seriously and were pleased with tt 


The 


following list provides an overview of the work done by tt 
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Ministry Consultations: 


Consumer and Business Services: Draft Privacy of 
Personal Information Act, 2002; Trusted Registration 
Policy; Identity Theft; Electronic Service Delivery 
implementation; 


Ministry of Transportation: Uninsured Vehicle 
Project; Ignition Interlock Program; Authorized 
Requester Program; 


Ministry of the Attorney General: Regulation under 
the Remedies for Organized Crime and Other Unlawful 
Activities Act; Amendments to the Public Guardian 
and Trustee Act and the Crown Administration of 
Estates Act; 


Ministry of Finance: Indirect collection for Ontario 
Savings Bonds; Province of Ontario Savings Office 


privatization, 


Community and Family Services: Mandatory drug 
treatment for social assistance recipients; Family 
Responsibility Office 
Bill 77, proposed Adoption Disclosure Statute Law 
Amendment Act; 


policies and _ procedures; 


Ministry of Health and Long-Term Care: PIA for the 
Health Services Payment Analysis System of OHIP; 
Postscript issues arising from Order PO 1881; Smart 
Systems for Health, E-Physician Project; Healthy 
Babies, Healthy Children project; 


Ministry of Public Safety and Security: Electronic 
Surveillance Program; Ontario Provincial Police facility 


design; Bill 148, the Emergency Readiness Act, 2002; 


extent to which ministries sought our advice during 2002 
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¢ Ontario Lottery and Gaming Commission: lottery 
related privacy issues; 


e Ministry of the Environment: Environet PIAs; 


e Management Board of Cabinet: Bill 216, Accountability 
for Expenses Act; Information Security Classification 
Policy; Employee Security Screening Policy; 


e City of Hamilton: video surveillance cameras; 


¢ Submission to the Ministry of Consumer and 
Business Services in response to a Consultation Draft 


of the Privacy of Personal Information Act, 2002; 


e Submission to the federal Minister of Transportation 


on Bill C-22, the proposed Public Safety Act; 


e Submissions to the federal Minister of National 
Revenue regarding the Canada Customs and Revenue 


Agency’s plans to retain personal information; 


e Submission to the Standing Committee on General 
Government regarding Bill 58; An Act to Amend 
Certain Statutes in Relation to the Energy Sector; 


e Submission to the federal Minister of Justice and 
Attorney General regarding the “Lawful Access” 


proposals. 
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Commissioner 


Director of 
Policy & 
Compliance 


Policy & Compliance 
Research 


Registrar & 
Tribunal 
Support 


Assistant 
Commissioner 


& Head of 
Tribunal Services 


Adjudication 


Mediation 


: 2002-2003 2001-2002 2001-2002 

; ; Estimates $ Estimates $ Actual $ 

} Salaries and wages 5,154,500 . 5,154,500 5,063,391 
Employee benefits 1,005,100 799,000 744,018 

> Transportation and Communications 180,400 162,300 168,706 

Services 840,200 860,500 888,937 

1D, Supplies and Equipment 275,400 273,200 221,974 

- Total 7,455,600 7,249,500 7,087,026 


Note: The IPC’s fiscal year begins April 1 and ends March 31. 


The financial administration of the IPC is audited on an annual basis by the Provincial Auditor. 
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As required by the Public Sector Salary Disclosure Act, 1996, the following chart shows which IPC 


employees received more than $100,000 in salary and benefits for the calendar year ending December 


31, 2002, 
Name Position Salary Paid Taxable Benefits 
Cavoukian, Ann Commissioner $ 171,343.96 $ 366.88 
Mitchinson, Tom Assistant Commissioner $ 164,715.20 $ 350.92 
Anderson, Ken Director, Legal Services $ 149,718.46 $ 339.54 
Beamaish, Brian Director, Policy & Compliance $7675.22 $ 221.16 
Challis, William General Counsel $ 166,002.91 $ 352.14 
Goldstein, Judith Legal Counsel $ 13154752 $ 272.71 
Goodis, David Senior Adjudicator & 

Manager of Adjudication $ 140,439.83 $ 284.09 
Higgins, John Legal Counsel $ 141,063.56 $ 293.94 
O’Donoghue, Mary Manager, Legal Services $ 142,742.80 $ 289.19 
Swaigen, John Legal Counsel $ 138,264.08 $ 294.48 
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